CVE-2026-57224 in Suricata
Summary
by MITRE • 09/18/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Suricata serves as a critical component in modern network security infrastructure, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Within the specific versions ranging from 8.0.0 to 8.0.6, a significant architectural flaw exists within its application layer parsing logic, specifically affecting the DHCP and RDP parsers implemented in Rust. The core technical deficiency lies in how these parsers handle stateful transaction tracking relative to packet directionality. When processing packets for Dynamic Host Configuration Protocol or Remote Desktop Protocol sessions, the engine fails to record the specific direction of each observed packet using the AppLayerTxData::for_direction() mechanism. This omission results in the creation of stateless transactions that lack complete directional context, which is essential for maintaining accurate session states in bidirectional network communications.
The operational impact of this defect becomes apparent when a Suricata sensor observes traffic flowing in only one direction. Because the parser does not properly mark the unseen direction as inspected or completed, it cannot correctly determine when a transaction has fully concluded from both perspectives. Consequently, these incomplete transactions are never removed from the per-flow transaction list. Over time, as new packets arrive for these orphaned sessions, the list grows without bound. This uncontrolled accumulation of stale state data leads to severe resource exhaustion issues. The system is forced to repeatedly scan an increasingly large transaction list during cleanup operations, which consumes excessive CPU cycles and memory resources.
This behavior ultimately results in a denial of service condition where the Suricata engine becomes unresponsive or crashes due to resource depletion. From a vulnerability classification perspective, this issue aligns with CWE-400, which denotes Uncontrolled Resource Consumption, as well as CWE-756, Missing Optional Security Feature, specifically regarding the failure to implement proper state management for bidirectional protocols. In terms of attack vectors and detection techniques, this flaw relates to ATT&CK technique T1498, Network Denial of Service, where an attacker could potentially trigger or accelerate this condition by generating specific traffic patterns that exploit the lack of directional transaction tracking. The vulnerability highlights a critical gap in how application layer protocols are statefully tracked when asymmetric packet visibility is present within the monitoring environment.
The resolution for this issue was implemented and released in Suricata version 8.0.6, which corrects the direction-state defect by ensuring that transactions are properly marked based on observed directions and cleaned up appropriately once sessions conclude. To mitigate the risk associated with versions prior to 8.0.6, organizations must upgrade their Suricata installations immediately if they rely on this software for critical network security monitoring or intrusion prevention. Until an upgrade is performed, administrators should be aware that high volumes of DHCP or RDP traffic, particularly in asymmetric routing environments where one direction may not be fully captured by all sensors, could lead to performance degradation and service outages. Regular updates to the detection engine are essential to maintain resilience against such resource exhaustion vulnerabilities and ensure stable operation under varying network conditions.