CVE-2026-45769

ikev2: unbounded client transform storage can lead to resource exhaustion

Published Sep 10, 2026 CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.

Analysis

Technical impact

Suricata, an IDS/IPS engine, has a flaw that allows an attacker to send crafted UDP packets that cause the IKEv2 parser to store client transform data without bounds. This leads to arbitrary memory growth in Suricata, which can exhaust available resources and cause the engine to stop responding, resulting in a denial of service.

Affected Systems

Affected systems include Suricata installations using versions earlier than 7.0.16 in the 7.x line or earlier than 8.0.5 in the 8.x line, all distributed by the Open Information Security Foundation.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity; the EPSS score of 1% indicates a low exploitation probability, and the vulnerability is not yet in the CISA KEV catalog. Exploitation requires sending crafted UDP traffic to the Suricata instance, potentially from any remote host, which can cause the engine to exhaust memory and become unresponsive.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OISF

suricata

affected

Version	Status	Constraints
`>= 8.0.0, < 8.0.5`	affected	—
`< 7.0.16`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oisf:suricata::::::::
	cpe:2.3:a:oisf:suricata::::::::

No data.

Vendor Product Versions

Oisf

Suricata

Version	Status	Scheme	Platform
`[8.0.0,8.0.5)`	affected	semver	—
`[0,7.0.16)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Suricata to at least version 7.0.16 or 8.0.5.
If an upgrade is not possible, disable IKEv2 application-layer parsing in the Suricata configuration to prevent the vulnerable parsing logic from executing.
Use a rule to bypass IKE flows after the first packet, for example: alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;).
Optionally monitor Suricata’s memory usage for abnormal growth and set alerts to detect early signs of exhaustion.

Generated by OpenCVE AI on September 11, 2026 at 15:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.8% (1.787% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315
https://github.com/OISF/suricata/security/advisories/GHSA-hg2g-r464-5593
https://nvd.nist.gov/vuln/detail/CVE-2026-45769
https://redmine.openinfosecfoundation.org/issues/8415
https://www.cve.org/CVERecord?id=CVE-2026-45769

History

Sep 16, 2026 6:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:oisf:suricata::::::::

Sep 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-45769 https://www.cve.org/CVERecord?id=CVE-2026-45769
Metrics	threat_severity `None`	threat_severity `Important`

Sep 12, 2026 12:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 8:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oisf Oisf suricata
Vendors & Products		Oisf Oisf suricata

Sep 10, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Title		ikev2: unbounded client transform storage can lead to resource exhaustion
Weaknesses		CWE-400 CWE-770
References		https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 https://github.com/OISF/suricata/security/advisories/GHSA-hg2g-r464-5593 https://redmine.openinfosecfoundation.org/issues/8415
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`