Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M
CVE-2026-45769ikev2: unbounded client transform storage can lead to resource exhaustion
High 7.5
In plain English
A high-severity uncontrolled resource consumption in suricata from OISF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | no fix listed | DEBIAN-CVE-2026-45769 |
| Debian:14 | suricata | 1:8.0.5-1 | DEBIAN-CVE-2026-45769 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45769 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45769 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2026-45769 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-hg2g-r464-5593 x_refsource_CONFIRM
- https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/8415 x_refsource_MISC