Buffer Overflow Vulnerability in Suricata Network IDS/IPS Engine

CVE-2026-22258

What is CVE-2026-22258?

A vulnerability exists in the Suricata network IDS, IPS, and NSM engine that can be exploited via crafted DCERPC traffic. This can lead to uncontrolled buffer expansion, resulting in memory exhaustion and potentially terminating the Suricata process. Although this issue has been observed with DCERPC over UDP, it is believed that similar vulnerabilities exist for DCERPC over TCP and SMB. Users are urged to update to versions 8.0.3 or 7.0.14, which contain critical patches. Workarounds include disabling the parser for DCERPC/UDP or adjusting the stream.reassembly.depth configuration for both TCP and SMB connections to impose limits on the buffered data, although this may impact visibility.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References