CVE-2026-45761

Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

Published Sep 10, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.

Analysis

Technical impact

A crafted Suricata rule that uses mixed‑case frame syntax can trigger a heap buffer overflow while the engine is loading signatures. The flaw is exercised during rule parsing, not by network traffic, and can lead to memory corruption that may allow arbitrary code execution or cause the Suricata process to terminate.

Affected Systems

Suricata versions prior to 7.0.16 and 8.0.5 are vulnerable. The security patch is included in 7.0.16 and 8.0.5 and later releases.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The rendered heap corruption is reached through rule parsing; based on the description, the likely attack vector is local or remote injection of malicious rule files or a compromise that allows installation of custom rulesets.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OISF

suricata

affected

Version	Status	Constraints
`>= 8.0.0, < 8.0.5`	affected	—
`< 7.0.16`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oisf:suricata::::::::
	cpe:2.3:a:oisf:suricata::::::::

No data.

Vendor Product Versions

Oisf

Suricata

Version	Status	Scheme	Platform
`[8.0.0,8.0.5)`	affected	semver	—
`[0,7.0.16)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Suricata to version 7.0.16 or later (8.0.5 or newer).
Preprocess rule files to ensure that frame syntax is written in lowercase before loading.
Load only trusted and verified rule sets to avoid introducing malicious or malformed frames.

Generated by OpenCVE AI on September 11, 2026 at 04:09 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.179% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315
https://github.com/OISF/suricata/security/advisories/GHSA-r74x-74x5-r9vm
https://redmine.openinfosecfoundation.org/issues/8526

History

Sep 16, 2026 8:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:oisf:suricata::::::::

Sep 15, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oisf Oisf suricata
Vendors & Products		Oisf Oisf suricata

Sep 10, 2026 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Title		Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
Weaknesses		CWE-122
References		https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 https://github.com/OISF/suricata/security/advisories/GHSA-r74x-74x5-r9vm https://redmine.openinfosecfoundation.org/issues/8526
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}`