Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-45761 EUVD-2026-75755

Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

Published Sep 10, 2026 · Updated Sep 15, 2026 · Assigned by GitHub_M

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.

Affected products

VendorProductAffectedFixed
OISF suricata >= 8.0.0, < 8.0.5, < 7.0.16 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 suricata 1:8.0.5-1 —
Debian 13 suricata No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS suricata No fix yet —
Ubuntu 24.04 LTS suricata No fix yet —
Ubuntu 22.04 LTS suricata No fix yet —
Ubuntu 18.04 LTS suricata No fix yet —
Ubuntu 16.04 LTS suricata No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed suricata 8.0.5-1.1 openSUSE-SU-2026:10885-1

Advisories 1

References