Log in Start free

Vulnerability · Published Jan 27, 2026 · Assigned by GitHub_M

CVE-2026-22258Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion

High 7.5

In plain English

A high-severity uncontrolled resource consumption in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13suricata1:7.0.10-1+deb13u3DEBIAN-CVE-2026-22258
Debian:14suricata1:8.0.3-1DEBIAN-CVE-2026-22258
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2026-22258
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2026-22258
Ubuntu:25.10suricatano fix listedUBUNTU-CVE-2026-22258

Affected products (as reported)

VendorProductVersions
OISF suricata < 7.0.14>= 8.0.0, < 8.0.3

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References