CVE-2026-45747

Katalog CVE

CVSS 7.5 · High EPSS 0,42%

Kerentanan NULL Pointer Dereference pada oisf suricata. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 release notes · advisory vendor
• https://github.com/OISF/suricata/security/advisories/GHSA-vfc5-9844-rmhv mitigasi · advisory vendor
• https://redmine.openinfosecfoundation.org/issues/6286 exploit · issue tracking · advisory vendor