Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M

CVE-2026-45752Suricata detect/transform: use-after-free in decompress transforms

Medium 5.9

In plain English

A medium-severity use-after-free in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13suricatano fix listedDEBIAN-CVE-2026-45752
Debian:14suricata1:8.0.5-1DEBIAN-CVE-2026-45752
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2026-45752
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2026-45752
Ubuntu:26.04:LTSsuricatano fix listedUBUNTU-CVE-2026-45752

Affected products (as reported)

VendorProductVersions
OISF suricata >= 8.0.0, < 8.0.5

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References