Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M
CVE-2026-45762Suricata defrag: missing address-family check can lead to remote crash
High 7.5
In plain English
A high-severity type confusion in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AF_PACKET, enabling AF_PACKET's `defrag` option may prevent Suricata from seeing such fragmented packets.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | no fix listed | DEBIAN-CVE-2026-45762 |
| Debian:14 | suricata | 1:8.0.5-1 | DEBIAN-CVE-2026-45762 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45762 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45762 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45762 |
Affected products (as reported)
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-gv2j-f6jv-3878 x_refsource_CONFIRM
- https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/8510 x_refsource_MISC