CVE-2026-57227

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Uncontrolled Resource Consumption pada oisf suricata. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-7h2h-hpj2-9w6p mitigasi · advisory vendor
• https://github.com/OISF/suricata/commit/03ba8a71d827dd36a0ceb512f45d2f440f260a3a patch
• https://github.com/OISF/suricata/commit/5cde93dea38533c9b225128ba9d54955997dc273 patch
• https://github.com/OISF/suricata/commit/c03666d261256df5a2d1f5800872da8a5addf6a5 patch
• https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 release notes
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes
• https://redmine.openinfosecfoundation.org/issues/8525 permissions required