Type Confusion Vulnerability in Suricata Network Security Management Software
CVE-2026-45764

9.1CRITICAL

Key Information:

Vendor

Oisf

Status
Suricata
Vendor
CVE Published:
10 September 2026

What is CVE-2026-45764?

Suricata is a versatile engine designed for network intrusion detection, prevention, and monitoring. Before the releases of versions 7.0.16 and 8.0.5, a protocol alteration in handling HTTP/2 traffic could lead to a type confusion scenario. This flaw may allow attackers to send crafted traffic that could destabilize Suricata, resulting in a denial of service. To safeguard against this vulnerability, users are encouraged to disable HTTP/2 parsing if it is not a necessary feature in their deployments. The latest versions contain patches addressing this issue.

Affected Version(s)

suricata >= 8.0.0, < 8.0.5 < 8.0.0, 8.0.5

suricata < 7.0.16 < 7.0.16

References

https://github.com/OISF/suricata/security/advisories/GHSA...
x_refsource_CONFIRM
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-rel...
x_refsource_MISC
https://redmine.openinfosecfoundation.org/issues/8492
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.