Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-63446Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

High 7.5

In plain English

A high-severity memory leak in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13suricatano fix listedDEBIAN-CVE-2026-63446
Debian:14suricata1:8.0.6-1DEBIAN-CVE-2026-63446
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2026-63446
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2026-63446
Ubuntu:26.04:LTSsuricatano fix listedUBUNTU-CVE-2026-63446

Affected products (as reported)

VendorProductVersions
OISF suricata >= 8.0.0, < 8.0.6

Weakness: CWE-401, CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References