CVE-2026-45770

Suricata lua: excessive flow variable registration can bypass sandbox

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

Analysis

AI-generated

Technical impact

The vulnerability allows a Lua rule that registers an excessive number of flow variables to corrupt Suricata's internal detection state, which may enable an attacker to bypass the engine's restricted Lua sandbox and also cause Suricata to terminate unexpectedly. The flaw is tied to mismanagement of memory and input handling, reflected in the CWE identifiers for improper type handling and out‑of‑bounds writes. The issue exists in Suricata versions 8.0.0 through 8.0.4; it was fixed in version 8.0.5, so systems using the affected releases must upgrade.

Affected Systems

OISF Suricata deployments running version 8.0.0 through 8.0.4 are vulnerable. The security update that resolves the issue is included in version 8.0.5 and later.

Risk and Exploitability

The CVSS score of 7.5 indicates information is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to introduce a Lua rule that triggers the over‑registration of flow variables; thus the attack vector is considered likely local or via compromise of rule management processes.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Suricata to version 8.0.5 or later to obtain the vendor fix.
  • If a patch cannot be applied immediately, set security.lua.allow-rules to false to prevent loading Lua rules that could register too many flow variables.
  • Audit rule files for unauthorized Lua scripts and monitor Suricata logs for lua‑related errors to detect potential exploitation attempts.

Generated by OpenCVE AI on September 11, 2026 at 04:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Oisf
Oisf suricata
Vendors & Products Oisf
Oisf suricata
Type Values Removed Values Added
Description Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Title Suricata lua: excessive flow variable registration can bypass sandbox
Weaknesses CWE-693
CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Sep 11, 2026, 2:37 PM
Reserved
May 13, 2026, 7:45 AM

View source JSON

Updated
Sep 11, 2026, 2:36 PM

JSON

Status
Analyzed
Published
Sep 10, 2026, 10:16 PM
Modified
Sep 16, 2026, 6:28 PM

View source JSON

No data.

Updated
Sep 11, 2026, 6:45 AM

JSON