CVE-2026-45752
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-416
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- OISF suricata
Weakness type
Related vulnerabilities
- CVE-2026-78133 — libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision...
- CVE-2026-45751 — Suricata detect/transform: use-after-free in dotprefix transform
- CVE-2026-88032 — Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
- CVE-2026-87933 — DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
- CVE-2026-87877 — zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
- CVE-2026-87825 — zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
- CVE-2026-87617 — Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87448 — Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...