Network Intrusion Detection System Vulnerability in Suricata

CVE-2026-45770

What is CVE-2026-45770?

The issue in Suricata involves a Lua rule that can register excessive flow variables, leading to potential corruption of the Lua detection state. This may allow malicious rules to bypass the restricted Lua sandbox implemented by Suricata. Furthermore, excessive registration can lead to crashes of the Suricata engine. To mitigate this issue, it is recommended to update to version 8.0.5 or later, and as a temporary measure, disable the security.lua.allow-rules setting unless Lua rules are essential.

References