CVE-2026-45766 in Suricata
Summary
by MITRE • 09/11/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
Suricata operates as a high-performance network intrusion detection system, intrusion prevention system, and network security monitoring engine designed to inspect traffic in real-time for malicious activity or policy violations. A critical vulnerability was identified within the application-layer protocol parsers specifically handling Network File System (NFS) traffic prior to versions 7.0.16 and 8.0.5. This flaw stems from insufficient bounds checking on internal state structures used during the parsing process, which allows crafted NFS packets to trigger abnormal memory allocation behaviors that can exhaust system resources.
The technical root cause of this vulnerability is classified as a resource exhaustion issue where input validation fails to properly constrain the size or complexity of parsed data fields. When an attacker sends specially constructed NFS traffic containing malformed headers or excessively large payload segments, Suricata attempts to allocate memory based on these unbounded values rather than adhering to expected protocol limits. This leads to rapid and excessive consumption of system memory, which can quickly overwhelm available resources on the host running the inspection engine.
From a security operations perspective, this vulnerability presents a significant denial-of-service risk against network monitoring infrastructure. An adversary capable of injecting malicious NFS traffic into the monitored segment could trigger this condition remotely without requiring authentication or prior access to the target systems. The resulting memory exhaustion would cause Suricata to crash or become unresponsive, effectively blinding the organization to other potential threats occurring simultaneously on the same network segments and disrupting continuous security monitoring capabilities.
This flaw aligns with CWE-400, which describes conditions where resources are not properly constrained against their intended use leading to resource exhaustion. In terms of offensive cyber operations mapping, this vulnerability supports techniques associated with ATT&CK T1498 Network Denial of Service, specifically the sub-technique involving indirect network service disruption through application layer exploitation rather than simple volumetric flooding. The attack vector is classified as remote and requires only network access to deliver the crafted packets that trigger the memory allocation flaw within the parsing engine.
To mitigate this risk immediately, organizations should disable NFS application-layer inspection in Suricata configurations if NFS traffic analysis is not a required component of their security monitoring strategy. This configuration change prevents the vulnerable parser from being invoked during packet processing, thereby eliminating the attack surface entirely for this specific vector. For environments where NFS parsing must remain enabled due to compliance or operational requirements, upgrading to version 7.0.16 or later in the Suricata series is essential as these releases contain code corrections that enforce proper bounds checking on all state structures involved in NFS protocol analysis ensuring that memory allocation remains within safe and predictable limits regardless of input content.