CVE-2026-45768

Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

Published Sep 10, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.

Analysis

Technical impact

Starting with Suricata 8.0.0 and up to 8.0.4, the LDAP transaction state can collect an unbounded number of responses. Because LDAP traffic can be carried over UDP, crafted packets can force Suricata to allocate excessive memory, resulting in a denial of service. This vulnerability falls under the unbounded resource allocation flaw (CWE‑400) and resource exhaustion (CWE‑770).

Affected Systems

The flaw affects Suricata 8.0.0 through 8.0.4 released by OISF, where LDAP traffic over UDP can acquire an unlimited number of responses within a single transaction.

Risk and Exploitability

With a CVSS score of 7.5, this issue presents a high severity risk. The EPSS score is unavailable and it is not listed in the CISA KEV catalog, yet attackers can exploit it remotely by sending crafted LDAP responses over UDP, with no authentication required, to trigger a denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OISF

suricata

affected

Version	Status	Constraints
`>= 8.0.0, < 8.0.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oisf

Suricata

Version	Status	Scheme	Platform
`[8.0.0,8.0.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Suricata to version 8.0.5 or later to apply the fix.
Disable LDAP application‑layer parsing in the Suricata configuration if LDAP traffic is unnecessary.
Add an alert rule that bypasses alarms when ldap.responses.count exceeds 1024 to prevent rule‑based exploitation.

Generated by OpenCVE AI on September 11, 2026 at 04:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.700% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315
https://github.com/OISF/suricata/security/advisories/GHSA-cr4x-w4c4-57p7
https://nvd.nist.gov/vuln/detail/CVE-2026-45768
https://redmine.openinfosecfoundation.org/issues/8405
https://www.cve.org/CVERecord?id=CVE-2026-45768

History

Sep 16, 2026 6:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:oisf:suricata::::::::

Sep 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-45768 https://www.cve.org/CVERecord?id=CVE-2026-45768
Metrics	threat_severity `None`	threat_severity `Important`

Sep 11, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 8:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oisf Oisf suricata
Vendors & Products		Oisf Oisf suricata

Sep 10, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.
Title		Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
Weaknesses		CWE-400 CWE-770
References		https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 https://github.com/OISF/suricata/security/advisories/GHSA-cr4x-w4c4-57p7 https://redmine.openinfosecfoundation.org/issues/8405
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`