CVE-2026-22261

Katalog CVE

CVSS 5.3 · Medium EPSS 0,37%

Kerentanan Excessive Platform Resource Consumption within a Loop pada oisf suricata. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve configuration. The setting is disabled by default.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1050: Excessive Platform Resource Consumption within a Loop

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-5jvg-5j3p-34cf advisory vendor
• https://github.com/OISF/suricata/commit/3f0725b34c7871c2de4346c8af872f10f4501e44 patch
• https://github.com/OISF/suricata/commit/af246ae7ab1b70c09f83c0619b253095ccc18667 patch
• https://redmine.openinfosecfoundation.org/issues/8156 permissions required