Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M
CVE-2026-45761Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
Low 3.3
In plain English
A low-severity heap buffer overflow in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | no fix listed | DEBIAN-CVE-2026-45761 |
| Debian:14 | suricata | 1:8.0.5-1 | DEBIAN-CVE-2026-45761 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45761 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45761 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45761 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/OISF/suricata/security/advisories/GHSA-r74x-74x5-r9vm x_refsource_CONFIRM
- https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/8526 x_refsource_MISC