Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Published: 2026-09-10
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Bypass sandbox and potential crash
Action: Patch
AI Analysis

Impact

The vulnerability allows a Lua rule that registers an excessive number of flow variables to corrupt Suricata's internal detection state, which may enable an attacker to bypass the engine's restricted Lua sandbox and also cause Suricata to terminate unexpectedly. The flaw is tied to mismanagement of memory and input handling, reflected in the CWE identifiers for improper type handling and out‑of‑bounds writes. The issue exists in Suricata versions 8.0.0 through 8.0.4; it was fixed in version 8.0.5, so systems using the affected releases must upgrade.

Affected Systems

OISF Suricata deployments running version 8.0.0 through 8.0.4 are vulnerable. The security update that resolves the issue is included in version 8.0.5 and later.

Risk and Exploitability

The CVSS score of 7.5 indicates information is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to introduce a Lua rule that triggers the over‑registration of flow variables; thus the attack vector is considered likely local or via compromise of rule management processes.

Generated by OpenCVE AI on September 11, 2026 at 04:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Suricata to version 8.0.5 or later to obtain the vendor fix.
  • If a patch cannot be applied immediately, set security.lua.allow-rules to false to prevent loading Lua rules that could register too many flow variables.
  • Audit rule files for unauthorized Lua scripts and monitor Suricata logs for lua‑related errors to detect potential exploitation attempts.

Generated by OpenCVE AI on September 11, 2026 at 04:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
First Time appeared Oisf
Oisf suricata
Vendors & Products Oisf
Oisf suricata

Thu, 10 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Title Suricata lua: excessive flow variable registration can bypass sandbox
Weaknesses CWE-693
CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oisf Suricata
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T21:42:22.056Z

Reserved: 2026-05-13T07:45:21.251Z

Link: CVE-2026-45770

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-10T22:16:57.117

Modified: 2026-09-10T22:16:57.117

Link: CVE-2026-45770

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T06:45:06Z

Weaknesses