CVE-2026-45768 in Suricata
Summary
by MITRE • 09/10/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Suricata serves as a critical component in modern network security architectures, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Its ability to deeply inspect application-layer protocols is essential for identifying malicious traffic patterns and enforcing security policies. However, within the LDAP protocol parsing module of Suricata versions starting from 8.0.0 up to but not including version 8.0.5, a significant resource management flaw exists that undermines the stability of the system under specific network conditions. This vulnerability stems from how the application-layer inspection engine handles stateful tracking for Lightweight Directory Access Protocol transactions, specifically regarding the accumulation of response data structures during active sessions.
The technical root cause of this issue lies in an unbounded storage mechanism for LDAP transaction states. When Suricata processes LDAP traffic, it maintains a state object to track the progress and content of ongoing directory service queries and responses. In the affected versions, there is no upper limit imposed on the number of response objects that can be stored within a single transaction's state structure. While LDAP typically operates over TCP where connection limits naturally constrain session duration, the protocol specification also allows for operation over UDP via LDAP over UDP extensions or specific implementations. This flexibility introduces an attack vector because UDP is a connectionless protocol without inherent flow control mechanisms comparable to TCP handshakes and resets. An attacker can exploit this by sending crafted UDP packets that trigger Suricata to allocate memory for new response entries indefinitely, as the state machine does not enforce a cap on accumulated responses before discarding or finalizing the transaction context.
The operational impact of this vulnerability is primarily centered around resource exhaustion leading to denial of service conditions. As an adversary floods the network with malicious LDAP traffic over UDP, Suricata's memory consumption grows linearly and without bound relative to the volume of crafted packets received. This excessive memory allocation can quickly deplete available system resources on the host running the IDS or IPS engine. The consequences range from severe performance degradation, where legitimate traffic inspection is delayed due to resource contention, to complete service failure if the process consumes all available RAM and triggers an out-of-memory kill by the operating system kernel. Such a scenario effectively neutralizes the security monitoring capabilities of the infrastructure at that node, creating a blind spot in network defense while potentially causing cascading failures across dependent systems or load balancers relying on Suricata for traffic analysis.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and specifically relates to improper handling of input data leading to memory exhaustion. In the context of the MITRE ATT&CK framework, this flaw is exploitable via techniques associated with Resource Hijacking or Denial of Service attacks against network infrastructure components. The attacker leverages the protocol's legitimate functionality in an abusive manner to disrupt availability, which falls under tactics related to Impact and potentially Initial Access if the disruption allows for bypassing other security controls during the outage window. Understanding these mappings helps organizations prioritize remediation efforts based on standard threat intelligence frameworks rather than treating it as an isolated software bug.
To mitigate this risk immediately upon discovery or before upgrading, administrators should disable LDAP application-layer parsing in Suricata configuration files wherever such deep inspection is not strictly required for their specific security use case. This reduces the attack surface by preventing the vulnerable state machine from being instantiated for non-essential traffic flows. For environments where LDAP inspection must remain active, a compensating control involves deploying network-level filtering rules to limit the rate of UDP-based LDAP packets or restricting access to directory services based on source IP reputation and policy. Additionally, implementing ingress policing at the router or firewall level can help mitigate volumetric aspects of such attacks by dropping excessive traffic before it reaches the Suricata instance.
The definitive resolution requires upgrading Suricata to version 8.0.5 or later, where developers have implemented bounds checking within the LDAP transaction state management logic. This fix ensures that only a reasonable number of responses are stored per session, preventing unbounded memory growth regardless of whether the traffic arrives over TCP or UDP. Organizations should verify their current deployment versions and schedule an upgrade during maintenance windows to ensure continuity of security monitoring without exposure to this denial-of-service vector. Regular patch management cycles are essential for maintaining resilience against such protocol-level exploitation techniques that target stateful inspection engines.