Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-57224 EUVD-2026-83382

Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion

Published Sep 18, 2026 · Updated Sep 18, 2026 · Assigned by GitHub_M

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.

Affected products

VendorProductAffectedFixed
OISF suricata >= 8.0.0, < 8.0.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 suricata 1:8.0.6-1 —
Debian 13 suricata No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS suricata No fix yet —
Ubuntu 24.04 LTS suricata No fix yet —
Ubuntu 22.04 LTS suricata No fix yet —
Ubuntu 18.04 LTS suricata No fix yet —
Ubuntu 16.04 LTS suricata No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed suricata 8.0.6-1.1 openSUSE-SU-2026:11308-1

Advisories 1

References