Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-45751 EUVD-2026-75728

Suricata detect/transform: use-after-free in dotprefix transform

Published Sep 10, 2026 · Updated Sep 11, 2026 · Assigned by GitHub_M

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing buffer to be reallocated. The issue is reached during a specific network traffic processing, and requires a specific but not malicious rule. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, avoid rules that chain `dotprefix` transform after another one.

Affected products

VendorProductAffectedFixed
OISF suricata < 7.0.16, >= 8.0.0, < 8.0.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 suricata 1:8.0.5-1 —
Debian 13 suricata No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS suricata No fix yet —
Ubuntu 24.04 LTS suricata No fix yet —
Ubuntu 22.04 LTS suricata No fix yet —
Ubuntu 18.04 LTS suricata No fix yet —
Ubuntu 16.04 LTS suricata No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed suricata 8.0.5-1.1 openSUSE-SU-2026:10885-1

Advisories 1

References