CVE-2026-45765 in Suricata
Summary
by MITRE • 09/11/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
Suricata serves as a critical component in modern network security infrastructure, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Its ability to deeply inspect packet payloads across various protocols allows organizations to detect malicious activity and enforce security policies at the network layer. However, within this complex processing pipeline, specific protocol parsers must handle data reassembly with strict resource management controls to prevent system instability. In versions of Suricata prior to 7.0.16 and 8.0.5, a significant flaw existed in the DNP3 (Distributed Network Protocol) parser regarding how it managed memory during stream reassembly operations.
The technical root cause of this vulnerability lies in insufficient bounds checking within the DNP3 reassembly logic. When Suricata processes network traffic that requires packet reassembly to reconstruct complete protocol messages, it allocates buffers to store intermediate and final data states. In the affected versions, the parser did not enforce adequate limits on how much data could be buffered for a single session or stream when handling crafted DNP3 packets. This lack of enforcement means that an attacker can send specially constructed traffic designed to trigger continuous reassembly processes without hitting natural termination points or size constraints defined by the protocol specification itself.
This flaw directly maps to CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-787, Out-of-bounds Write, depending on the specific memory allocation behavior triggered by the malformed input. From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1498, Network Denial of Service, where adversaries leverage resource exhaustion to disrupt service availability rather than gaining unauthorized access or exfiltrating data. The attacker exploits the parser's inability to reject oversized or maliciously structured streams before they consume system resources.
The operational impact of this vulnerability is primarily a denial of service condition affecting the Suricata instance itself. By sending crafted DNP3 traffic, an adversary can force the engine to allocate excessive amounts of memory for reassembly buffers that are never properly released or bounded. This uncontrolled growth in memory usage leads to resource exhaustion on the host system running Suricata. In severe cases, this results in the process crashing due to out-of-memory errors or causes significant performance degradation across the entire network monitoring infrastructure as swap space is exhausted and CPU cycles are consumed by failed allocation attempts.
To mitigate this risk for environments still operating on vulnerable versions, immediate action is required if DNP3 inspection is enabled. Since DNP3 support is not active by default in most Suricata configurations, administrators should verify whether the protocol parser is engaged. If it is necessary to process DNP3 traffic, the recommended workaround involves explicitly configuring a limited value for stream.reassembly.depth. Setting this parameter to zero or removing its unlimited state forces the engine to discard streams that exceed a certain size threshold, thereby preventing the unbounded memory consumption described in the vulnerability report.
The definitive resolution requires upgrading Suricata to version 7.0.16 or later, specifically version 8.0.5 for those on the newer branch. These releases incorporate code changes that enforce strict bounds checking during DNP3 reassembly, ensuring that only valid and reasonably sized data streams are processed. Organizations relying on industrial control system monitoring via Suricata must prioritize this update to maintain both the integrity of their security operations center capabilities and the stability of their network infrastructure against potential denial-of-service attacks targeting protocol parsers.