CVE-2026-45769 in Suricata
Summary
by MITRE • 09/10/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
Suricata serves as a critical component in modern network security architectures, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Its ability to perform deep packet inspection across various application-layer protocols is essential for identifying malicious activity and enforcing security policies. However, the integrity of such systems relies heavily on their resilience against malformed or crafted inputs that attempt to exploit internal state management flaws. A significant vulnerability was identified within the IKEv2 parser module of Suricata in versions prior to 7.0.16 and 8.0.5. This flaw centers on an unbounded growth of the parser's internal state when processing client transforms during Internet Key Exchange version 2 negotiations, a protocol commonly used for establishing Virtual Private Networks.
The technical root cause of this vulnerability is classified under CWE-400, which denotes Uncontrolled Resource Consumption. Specifically, the IKEv2 parser failed to enforce strict limits on the memory allocated for storing client transform data structures during the parsing process. When Suricata encounters specially crafted UDP traffic designed to trigger this code path, it allocates new state entries without adequately checking or capping the total size of these structures relative to available system resources. This lack of bounds checking allows an attacker to induce a continuous expansion of memory usage by sending repeated packets that exploit the parsing logic. The vulnerability is particularly dangerous because IKEv2 traffic typically travels over UDP, which does not have built-in connection state tracking in many network environments, making it easier for attackers to flood the system with crafted payloads without triggering standard rate-limiting mechanisms associated with TCP connections.
The operational impact of this flaw is a severe denial of service condition resulting from excessive memory consumption. As the parser continues to store client transforms without bound, Suricata's process consumes increasing amounts of RAM until it either exhausts available memory or triggers an out-of-memory killer event within the operating system. This leads to the termination of the Suricata process, effectively disabling all intrusion detection and prevention capabilities for the network segment where the engine is deployed. Such a failure creates a critical security gap, allowing subsequent malicious traffic to pass through undetected while also causing service disruption that requires manual intervention or automatic restarts to restore functionality. This aligns with ATT&CK technique T1498, Network Denial of Service, as it involves impairing the availability of network resources by exploiting software vulnerabilities rather than simply overwhelming bandwidth capacity.
To mitigate this risk in environments where Suricata is deployed, immediate action is required for systems running vulnerable versions. The primary remediation strategy is to upgrade Suricata to version 7.0.16 or later, which includes patches that enforce proper bounds checking on the IKEv2 parser state management. For organizations unable to patch immediately due to operational constraints, specific workarounds are available to reduce exposure. One effective mitigation involves disabling application-layer parsing for IKE traffic if such inspection is not strictly required by security policies, thereby removing the attack surface entirely. Alternatively, administrators can implement a rule-based bypass strategy that limits the depth of inspection for IKE flows. By configuring a rule that triggers after a small number of packets have been processed from the server side, subsequent packets in that flow are bypassed rather than fully parsed. An example configuration involves using an alert rule with specific flow parameters to identify established IKE sessions and applying a bypass action to prevent further state accumulation on those connections. This approach balances security monitoring needs with resource protection by limiting deep inspection only to initial handshake phases where critical threat indicators might be present, while avoiding the unbounded memory growth associated with prolonged parsing of transform data.