CVE-2026-57226

Katalog CVE

CVSS 5.9 · Medium EPSS 0,59%

Kerentanan Heap-based Buffer Overflow pada oisf suricata. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-p33j-r48q-3jcf mitigasi · advisory vendor
• https://github.com/OISF/suricata/commit/82af0aeb7cec39e206a9ca96c4966425eddeaa74 patch
• https://github.com/OISF/suricata/commit/b63224871b0f8b0b1f7b8c22d05ba8a5c5f69fbb patch
• https://github.com/OISF/suricata/commit/d9fae18432501674338e28bd33e35788c95d4a98 patch
• https://github.com/OISF/suricata/pull/15704 patch
• https://redmine.openinfosecfoundation.org/issues/8642 exploit · issue tracking · advisory pihak ketiga
• https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 release notes
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes