Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.
Published: 2026-09-10
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

Starting with Suricata 8.0.0 and up to 8.0.4, the LDAP transaction state can collect an unbounded number of responses. Because LDAP traffic can be carried over UDP, crafted packets can force Suricata to allocate excessive memory, resulting in a denial of service. This vulnerability falls under the unbounded resource allocation flaw (CWE‑400) and resource exhaustion (CWE‑770).

Affected Systems

The flaw affects Suricata 8.0.0 through 8.0.4 released by OISF, where LDAP traffic over UDP can acquire an unlimited number of responses within a single transaction.

Risk and Exploitability

With a CVSS score of 7.5, this issue presents a high severity risk. The EPSS score is unavailable and it is not listed in the CISA KEV catalog, yet attackers can exploit it remotely by sending crafted LDAP responses over UDP, with no authentication required, to trigger a denial of service.

Generated by OpenCVE AI on September 11, 2026 at 04:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Suricata to version 8.0.5 or later to apply the fix.
  • Disable LDAP application‑layer parsing in the Suricata configuration if LDAP traffic is unnecessary.
  • Add an alert rule that bypasses alarms when ldap.responses.count exceeds 1024 to prevent rule‑based exploitation.

Generated by OpenCVE AI on September 11, 2026 at 04:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Oisf
Oisf suricata
Vendors & Products Oisf
Oisf suricata

Thu, 10 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Description Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.
Title Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oisf Suricata
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T21:37:17.659Z

Reserved: 2026-05-13T07:45:21.250Z

Link: CVE-2026-45768

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-10T22:16:56.827

Modified: 2026-09-10T22:16:56.827

Link: CVE-2026-45768

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T07:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling