OISF Suricata up to 8.0.5 detect-engine-prefilter.c heap-based overflow

Summaryinfo

A vulnerability has been found in OISF Suricata up to 8.0.5 and classified as problematic. This impacts an unknown function of the file src/detect-engine-prefilter.c. Performing a manipulation results in heap-based overflow. This vulnerability was named CVE-2026-63451. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OISF Suricata up to 8.0.5. It has been classified as problematic. This affects an unknown part of the file src/detect-engine-prefilter.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on availability. The summary by CVE is:

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-63451 since 07/16/2026. The exploitability is told to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 8.0.6 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion