CVE-2026-45770 in Suricata
Summary
by MITRE • 09/11/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
Suricata is widely recognized as a high-performance network intrusion detection system, intrusion prevention system, and network security monitoring engine that processes traffic in real-time to identify malicious activity. Within the architecture of Suricata, particularly starting from version 8.0.0 up until version 8.0.5, there exists a critical vulnerability associated with the handling of Lua-based rules. These rules allow for complex detection logic by leveraging the Lua scripting language embedded within the engine. The specific flaw arises when a Lua rule attempts to register an excessive number of flow variables. Flow variables are used to store state information about network connections, enabling the detection system to track context across multiple packets in a session. When this registration process is abused through overly complex or maliciously crafted rules, it can lead to memory corruption within the Lua detection state.
The technical nature of this vulnerability centers on improper validation and bounds checking during the allocation and management of flow variable structures. By registering too many variables, an attacker or misconfigured rule can exhaust available resources or corrupt internal data structures that manage the sandboxed environment for Lua scripts. This corruption has two significant operational impacts. First, it may allow a malicious actor to bypass Suricata's restricted Lua sandbox. The sandbox is designed to limit what Lua scripts can do, preventing them from accessing sensitive system resources or executing arbitrary code outside their intended scope. Bypassing this restriction effectively elevates the privileges of the script execution context, potentially leading to remote code execution if combined with other vulnerabilities or misconfigurations. Second, the resource exhaustion and memory corruption caused by excessive flow variable registration can lead to a denial of service condition, causing Suricata to crash unexpectedly and interrupt network monitoring capabilities.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing beyond allocated boundaries or corrupting state due to insufficient validation of input parameters related to variable registration. It also relates to CWE-209: Generation of Error Message Containing Sensitive Information if the crash reveals internal stack traces, and potentially CWE-1348: Code Injection if the sandbox bypass allows for arbitrary code execution within the context of the Suricata process. In terms of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Defense Evasion by allowing an attacker to circumvent detection mechanisms (T1562) and potentially Initial Execution or Command and Control activities depending on how the Lua script is utilized in a live environment.
The severity of this issue is contingent upon whether affected Lua rules are actively loaded into the Suricata configuration. If no custom Lua scripts are deployed, the attack surface for exploitation via this specific vector is significantly reduced but not entirely eliminated if default configurations include such capabilities. The vulnerability requires an attacker to have some level of influence over which Lua rules or scripts are loaded onto the system, either through direct access to the configuration files or by exploiting a separate vulnerability that allows rule injection. However, in environments where dynamic rule loading is permitted or where administrators frequently update detection signatures from third-party sources without rigorous vetting, this risk becomes substantial.
To mitigate this vulnerability, organizations running Suricata versions 8.0.0 through 8.0.4 should immediately upgrade to version 8.0.5 or later, which contains the necessary code fixes to properly validate and limit the number of flow variables that can be registered by Lua rules. For environments where upgrading is not immediately feasible, a recommended workaround is to disable the security.lua.allow-rules configuration option unless there is an explicit operational requirement for Lua-based detection logic. Disabling this setting prevents any custom or third-party Lua scripts from being executed within the Suricata engine, thereby eliminating the attack vector entirely. Administrators should also review their current rule sets and remove any unnecessary Lua dependencies to minimize the overall footprint of potential vulnerabilities associated with script execution engines in network security appliances.