Skip to content
OpenAdvisories
High · 7.5 CVE-2026-45770 EUVD-2026-75797

Suricata lua: excessive flow variable registration can bypass sandbox

Published Sep 10, 2026 · Updated Sep 11, 2026 · Assigned by GitHub_M

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

Affected products

VendorProductAffectedFixed
OISF suricata >= 8.0.0, < 8.0.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 suricata 1:8.0.5-1 —
Debian 13 suricata No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS suricata No fix yet —
Ubuntu 24.04 LTS suricata No fix yet —
Ubuntu 22.04 LTS suricata No fix yet —
Ubuntu 18.04 LTS suricata No fix yet —
Ubuntu 16.04 LTS suricata No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed suricata 8.0.5-1.1 openSUSE-SU-2026:10885-1

Advisories 1

References