OISF suricata vulnerabilities

CVEs per yearBy the year they were published

1. 202417
2. 202521
3. 202648

Newest CVEs

• CVE-2026-94084

  Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a…

  OISF · Suricata

  Critical9.4
• CVE-2026-94083

  Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual…

  OISF · Suricata

  Critical9.4
• CVE-2026-71855

  Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

  OISF · suricata

  Medium5.9
• CVE-2026-71418

  Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption

  OISF · suricata

  High7.5
• CVE-2026-57223

  Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

  OISF · suricata

  High7.0
• CVE-2026-63446

  Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

  OISF · suricata

  High7.5
• CVE-2026-63447

  Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption

  OISF · suricata

  High7.5
• CVE-2026-63448

  Suricata smb: some SMB flows can cause resource exhaustion

  OISF · suricata

  Medium5.9
• CVE-2026-57229

  Suricata smtp/mime: incomplete state reset allows detection bypass

  OISF · suricata

  Medium5.3
• CVE-2026-57225

  Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

  OISF · suricata

  Low3.3