OOISF

Products

Exploited and recent CVEs

• CVE-2026-94084 Critical 9.4 Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform. 0.5%
• CVE-2026-94083 Critical 9.4 Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request 0.5%
• CVE-2026-71855 Medium 5.9 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state 0.3%
• CVE-2026-71418 High 7.5 Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption 0.6%
• CVE-2026-57223 High 7.0 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation 0.2%
• CVE-2026-63446 High 7.5 Suricata app-layer: passed flows can retain transactions, causing resource exhaustion 0.7%
• CVE-2026-63447 High 7.5 Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption 0.6%
• CVE-2026-63448 Medium 5.9 Suricata smb: some SMB flows can cause resource exhaustion 0.4%
• CVE-2026-57229 Medium 5.3 Suricata smtp/mime: incomplete state reset allows detection bypass 0.4%
• CVE-2026-57225 Low 3.3 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading 0.2%
• CVE-2026-63452 High 7.5 Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption 0.6%
• CVE-2026-63451 Low 3.3 Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load 0.1%
• CVE-2026-57227 High 7.5 Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages 0.7%
• CVE-2026-63450 Low 3.7 Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection 0.2%
• CVE-2026-63449 Low 3.7 Suricata sip: large SIP message bodies can evade detection with frame keyword 0.2%
• CVE-2026-57228 High 8.2 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder 0.4%
• CVE-2026-57224 Medium 6.5 Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion 0.4%
• CVE-2026-57226 Low 3.7 Suricata swf: heap buffer overflow in SWF decompression depth handling 0.6%
• CVE-2026-57222 Medium 5.3 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 0.4%
• CVE-2026-46352 High 7.5 Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock 0.5%
• CVE-2026-45770 High 7.5 Suricata lua: excessive flow variable registration can bypass sandbox 0.5%
• CVE-2026-45769 High 7.5 ikev2: unbounded client transform storage can lead to resource exhaustion 1.8%
• CVE-2026-45768 High 7.5 Suricata ldap: unbounded responses per transaction can lead to resource exhaustion 0.7%
• CVE-2026-45767 Medium 4.4 Suricata datasets: save to absolute filename can be bypassed when combined with load command 0.4%
• CVE-2026-45766 High 7.5 Suricata nfs: unbounded stateful structures can lead to resource exhaustion 0.6%
• CVE-2026-45765 High 7.5 Suricata dnp3: unbounded reassembly can lead to resource exhaustion 0.6%
• CVE-2026-45764 Critical 9.1 Suricata http2: protocol-change type confusion can lead to denial of service 0.6%
• CVE-2026-45762 High 7.5 Suricata defrag: missing address-family check can lead to remote crash 0.6%
• CVE-2026-45761 Low 3.3 Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load 0.2%
• CVE-2026-45759 High 7.5 Suricata http1: quadratic Content-Disposition processing can lead to denial of service 0.8%