https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-94084.htmlhttps://patchthecve.com/cve/CVE-2026-94084.htmlMon, 28 Sep 2026 18:29:51 +0000CRITICAL 9.4: Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.https://patchthecve.com/cve/CVE-2026-94083.htmlhttps://patchthecve.com/cve/CVE-2026-94083.htmlMon, 28 Sep 2026 18:30:00 +0000CRITICAL 9.4: Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is thehttps://patchthecve.com/cve/CVE-2026-71855.htmlhttps://patchthecve.com/cve/CVE-2026-71855.htmlMon, 28 Sep 2026 18:39:08 +0000MEDIUM 5.9: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion levhttps://patchthecve.com/cve/CVE-2026-71418.htmlhttps://patchthecve.com/cve/CVE-2026-71418.htmlMon, 28 Sep 2026 18:39:56 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiplhttps://patchthecve.com/cve/CVE-2026-63452.htmlhttps://patchthecve.com/cve/CVE-2026-63452.htmlMon, 28 Sep 2026 18:40:07 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With responsehttps://patchthecve.com/cve/CVE-2026-63451.htmlhttps://patchthecve.com/cve/CVE-2026-63451.htmlMon, 28 Sep 2026 18:33:00 +0000LOW 3.3: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.https://patchthecve.com/cve/CVE-2026-63450.htmlhttps://patchthecve.com/cve/CVE-2026-63450.htmlMon, 28 Sep 2026 18:33:07 +0000LOW 3.7: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable phttps://patchthecve.com/cve/CVE-2026-63449.htmlhttps://patchthecve.com/cve/CVE-2026-63449.htmlMon, 28 Sep 2026 18:33:18 +0000LOW 3.7: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the lengthttps://patchthecve.com/cve/CVE-2026-63448.htmlhttps://patchthecve.com/cve/CVE-2026-63448.htmlMon, 28 Sep 2026 18:33:31 +0000MEDIUM 5.9: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because chttps://patchthecve.com/cve/CVE-2026-63447.htmlhttps://patchthecve.com/cve/CVE-2026-63447.htmlMon, 28 Sep 2026 18:34:20 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk ofhttps://patchthecve.com/cve/CVE-2026-63446.htmlhttps://patchthecve.com/cve/CVE-2026-63446.htmlMon, 28 Sep 2026 18:34:40 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows https://patchthecve.com/cve/CVE-2026-57229.htmlhttps://patchthecve.com/cve/CVE-2026-57229.htmlMon, 28 Sep 2026 18:35:07 +0000MEDIUM 5.3: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encohttps://patchthecve.com/cve/CVE-2026-57228.htmlhttps://patchthecve.com/cve/CVE-2026-57228.htmlTue, 29 Sep 2026 12:47:52 +0000HIGH 8.2: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split acroshttps://patchthecve.com/cve/CVE-2026-57227.htmlhttps://patchthecve.com/cve/CVE-2026-57227.htmlTue, 29 Sep 2026 12:48:01 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTThttps://patchthecve.com/cve/CVE-2026-57225.htmlhttps://patchthecve.com/cve/CVE-2026-57225.htmlMon, 28 Sep 2026 18:35:19 +0000LOW 3.3: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed contahttps://patchthecve.com/cve/CVE-2026-57223.htmlhttps://patchthecve.com/cve/CVE-2026-57223.htmlTue, 29 Sep 2026 12:48:12 +0000HIGH 7.0: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata https://patchthecve.com/cve/CVE-2026-57226.htmlhttps://patchthecve.com/cve/CVE-2026-57226.htmlMon, 28 Sep 2026 18:36:20 +0000LOW 3.7: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/uthttps://patchthecve.com/cve/CVE-2026-57224.htmlhttps://patchthecve.com/cve/CVE-2026-57224.htmlMon, 28 Sep 2026 18:36:45 +0000MEDIUM 6.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sehttps://patchthecve.com/cve/CVE-2026-57222.htmlhttps://patchthecve.com/cve/CVE-2026-57222.htmlTue, 29 Sep 2026 12:48:22 +0000MEDIUM 5.3: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-backed https://patchthecve.com/cve/CVE-2026-46352.htmlhttps://patchthecve.com/cve/CVE-2026-46352.htmlMon, 28 Sep 2026 18:32:50 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol https://patchthecve.com/cve/CVE-2026-45770.htmlhttps://patchthecve.com/cve/CVE-2026-45770.htmlWed, 16 Sep 2026 18:28:14 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbhttps://patchthecve.com/cve/CVE-2026-45769.htmlhttps://patchthecve.com/cve/CVE-2026-45769.htmlWed, 16 Sep 2026 18:28:27 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive https://patchthecve.com/cve/CVE-2026-45768.htmlhttps://patchthecve.com/cve/CVE-2026-45768.htmlWed, 16 Sep 2026 18:31:31 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic mayhttps://patchthecve.com/cve/CVE-2026-45767.htmlhttps://patchthecve.com/cve/CVE-2026-45767.htmlWed, 16 Sep 2026 20:18:43 +0000MEDIUM 4.4: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some worhttps://patchthecve.com/cve/CVE-2026-45766.htmlhttps://patchthecve.com/cve/CVE-2026-45766.htmlWed, 16 Sep 2026 20:18:22 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially rhttps://patchthecve.com/cve/CVE-2026-45765.htmlhttps://patchthecve.com/cve/CVE-2026-45765.htmlWed, 16 Sep 2026 20:18:06 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, pothttps://patchthecve.com/cve/CVE-2026-45764.htmlhttps://patchthecve.com/cve/CVE-2026-45764.htmlWed, 16 Sep 2026 20:17:56 +0000CRITICAL 9.1: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resultinghttps://patchthecve.com/cve/CVE-2026-45762.htmlhttps://patchthecve.com/cve/CVE-2026-45762.htmlMon, 28 Sep 2026 18:44:35 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processedhttps://patchthecve.com/cve/CVE-2026-45761.htmlhttps://patchthecve.com/cve/CVE-2026-45761.htmlWed, 16 Sep 2026 20:17:47 +0000LOW 3.3: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached durinhttps://patchthecve.com/cve/CVE-2026-45759.htmlhttps://patchthecve.com/cve/CVE-2026-45759.htmlWed, 16 Sep 2026 20:17:31 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP `Content-Disposition` headers during HTTP response body processing. Crafted HTTPhttps://patchthecve.com/cve/CVE-2026-45752.htmlhttps://patchthecve.com/cve/CVE-2026-45752.htmlMon, 28 Sep 2026 18:44:43 +0000MEDIUM 5.9: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it hhttps://patchthecve.com/cve/CVE-2026-45751.htmlhttps://patchthecve.com/cve/CVE-2026-45751.htmlMon, 28 Sep 2026 18:44:52 +0000MEDIUM 5.9: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing bufferhttps://patchthecve.com/cve/CVE-2026-46387.htmlhttps://patchthecve.com/cve/CVE-2026-46387.htmlMon, 28 Sep 2026 18:44:12 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA paylhttps://patchthecve.com/cve/CVE-2026-45747.htmlhttps://patchthecve.com/cve/CVE-2026-45747.htmlMon, 28 Sep 2026 18:44:03 +0000HIGH 7.5: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic wherhttps://patchthecve.com/cve/CVE-2026-45763.htmlhttps://patchthecve.com/cve/CVE-2026-45763.htmlMon, 28 Sep 2026 18:43:52 +0000MEDIUM 5.9: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua https://patchthecve.com/cve/CVE-2026-31937.htmlhttps://patchthecve.com/cve/CVE-2026-31937.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15.https://patchthecve.com/cve/CVE-2026-31935.htmlhttps://patchthecve.com/cve/CVE-2026-31935.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.https://patchthecve.com/cve/CVE-2026-31934.htmlhttps://patchthecve.com/cve/CVE-2026-31934.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, there is a quadratic complexity issue when searching for URLs in mime encoded messages over SMTP leading to a performance impact. This issue has been patched in version 8.0.4.https://patchthecve.com/cve/CVE-2026-31933.htmlhttps://patchthecve.com/cve/CVE-2026-31933.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4.https://patchthecve.com/cve/CVE-2026-31932.htmlhttps://patchthecve.com/cve/CVE-2026-31932.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, inefficiency in KRB5 buffering can lead to performance degradation. This issue has been patched in versions 7.0.15 and 8.0.4.https://patchthecve.com/cve/CVE-2026-31931.htmlhttps://patchthecve.com/cve/CVE-2026-31931.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.