Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-57225Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

Low 3.3

In plain English

A low-severity null pointer dereference in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13suricatano fix listedDEBIAN-CVE-2026-57225
Debian:14suricata1:8.0.6-1DEBIAN-CVE-2026-57225
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2026-57225
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2026-57225
Ubuntu:26.04:LTSsuricatano fix listedUBUNTU-CVE-2026-57225

Affected products (as reported)

VendorProductVersions
OISF suricata >= 8.0.0, < 8.0.6

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References