CVE-2026-57225

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan NULL Pointer Dereference pada oisf suricata. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc mitigasi · advisory vendor
• https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5 patch
• https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53 patch
• https://github.com/OISF/suricata/pull/15699 patch
• https://redmine.openinfosecfoundation.org/issues/8624 exploit · issue tracking · mitigasi · advisory pihak ketiga
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes