CVE-2026-57227 in Suricata
Summary
by MITRE • 09/18/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Suricata serves as a critical component in modern network security architectures, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Its ability to inspect high volumes of traffic relies heavily on efficient parsing engines for various protocols, including the Message Queuing Telemetry Transport protocol commonly used in Internet of Things deployments and industrial control systems. Within this framework, the MQTT parser implemented in Rust is responsible for interpreting client-server communication patterns defined by the MQTT specification. The vulnerability identified affects versions ranging from 7.0.0 through 7.0.17 as well as version 8.0.6, highlighting a significant gap in state management logic during protocol analysis.
The core technical flaw resides in the handling of specific control packets within the MQTT transaction lifecycle. Specifically, the parser fails to enforce limits on the accumulation of PUBREC and PUBREL messages associated with a single transaction. Under normal operational conditions, these messages are part of the standard Quality of Service level two delivery mechanism, where acknowledgments ensure reliable message transmission. However, an attacker can craft malicious MQTT traffic that repeatedly sends these acknowledgment packets without completing or closing the underlying transaction context. Because the parser does not impose a cap on how many such messages can be appended to one active session state, it allows this data structure to grow indefinitely in memory.
This unbounded growth leads directly to resource exhaustion within the Suricata process. As the transaction state expands due to the continuous ingestion of crafted packets, the system consumes increasing amounts of Central Processing Unit cycles for parsing and processing these entries while simultaneously allocating more Random Access Memory to store the expanding state structures. This behavior effectively creates a denial of service condition where legitimate network traffic is either dropped or processed with significant latency due to resource contention. The impact extends beyond simple performance degradation; in high-throughput environments, this vulnerability can cause the entire security engine to become unresponsive, thereby creating a blind spot for other potential threats and compromising the availability of critical monitoring infrastructure.
From a classification perspective, this issue aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-787, indicating Out-of-bounds Write if memory corruption occurs during state expansion, though primarily it manifests as resource exhaustion. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability is exploitable via T1498 Network Denial of Service, specifically through network fatigue techniques that overwhelm target resources with high-volume traffic. The attack vector typically involves remote exploitation over TCP connections targeting port 1883 or 8883, depending on whether encryption is employed by the MQTT broker being monitored.
Mitigation strategies must prioritize immediate version upgrades to address this flaw in the parsing logic. Organizations running affected versions should upgrade Suricata to either version 7.0.17 or later within the seven series, or version 8.0.6 and newer for the eight series, where the fix has been implemented to enforce strict limits on transaction state growth. In environments where immediate patching is not feasible due to operational constraints, network segmentation can provide a temporary layer of defense by restricting MQTT traffic from untrusted sources before it reaches the Suricata instance. Additionally, implementing rate limiting at the network perimeter or within load balancers can help mitigate the volume of crafted packets reaching the parser, thereby reducing the risk of resource exhaustion while permanent remediation is planned and executed.