CVE-2026-22264

Katalog CVE

CVSS 9.1 · Critical EPSS 0,40%

Kerentanan Use After Free pada oisf suricata. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-mqr8-m3m4-2hw5 advisory vendor
• https://github.com/OISF/suricata/commit/549d7bf60616de8e54686a188196453b5b22f715 patch
• https://github.com/OISF/suricata/commit/5789a3d3760dbf33d93fc56c27bd9529e5bdc8f2 patch
• https://github.com/OISF/suricata/commit/ac1eb394181530430fb7262969f423a1bf8f209b patch
• https://redmine.openinfosecfoundation.org/issues/8190 permissions required