Use-After-Free Vulnerability in Suricata Network Engine

CVE-2026-22264

What is CVE-2026-22264?

The Suricata network intrusion detection and prevention system is susceptible to an unsigned integer overflow, resulting in a use-after-free condition when it processes a high volume of alerts generated from a single packet. This vulnerability exists in versions prior to 8.0.3 and 7.0.14. Users are urged to upgrade to the latest versions or implement workarounds, such as avoiding untrusted rulesets and limiting the number of signatures configured to match packets to less than 65536. Failure to address this vulnerability could allow attackers to execute arbitrary code or cause service disruption.

References