Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-31931Suricata tls: null dereference in tls.alpn rule keyword
High 7.5
In plain English
A high-severity null pointer dereference in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | suricata | 8.0.6-r0 | ALPINE-CVE-2026-31931 |
| Debian:14 | suricata | 1:8.0.4-1 | DEBIAN-CVE-2026-31931 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-31931 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-31931 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2026-31931 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-31931 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2026-31931 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-gr22-4784-xvw3 x_refsource_CONFIRM
- https://redmine.openinfosecfoundation.org/issues/8294 x_refsource_MISC