CVE-2026-45766

EUVD-2026-75767

10.09.2026, 22:16

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 48.93%

Affected Products (NVD)

Vendor	Product	Version
oisf	suricata	7.0.0 ≤ 𝑥 < 7.0.16
oisf	suricata	8.0.0 ≤ 𝑥 < 8.0.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

suricata

forky	1:8.0.7-2 fixed
sid	1:8.0.7-2 fixed
trixie	ignored

Ubuntu Releases

Ubuntu Product

Codename

suricata

bionic	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315

https://github.com/OISF/suricata/security/advisories/GHSA-jqr4-ch38-wvm6

https://redmine.openinfosecfoundation.org/issues/8418