Vulnerability · Published Jan 27, 2026 · Assigned by GitHub_M

CVE-2026-22259Suricata dnp3: unbounded transaction growth

High 7.5

In plain English

A high-severity uncontrolled resource consumption in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	suricata	1:7.0.10-1+deb13u3	DEBIAN-CVE-2026-22259
Debian:14	suricata	1:8.0.3-1	DEBIAN-CVE-2026-22259
Ubuntu:22.04:LTS	suricata	no fix listed	UBUNTU-CVE-2026-22259
Ubuntu:24.04:LTS	suricata	no fix listed	UBUNTU-CVE-2026-22259
Ubuntu:25.10	suricata	no fix listed	UBUNTU-CVE-2026-22259

Affected products (as reported)

Vendor	Product	Versions
OISF	suricata	< 7.0.14>= 8.0.0, < 8.0.3

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9 x_refsource_CONFIRM
https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e x_refsource_MISC
https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942 x_refsource_MISC
https://redmine.openinfosecfoundation.org/issues/8181 x_refsource_MISC