Network Intrusion Detection System Vulnerability in Suricata by Open Information Security Foundation

CVE-2026-63446

What is CVE-2026-63446?

The vulnerability in Suricata's AppLayerParserSetTransactionInspectId function allows certain transactions to remain unmarked due to an inverted guard. This leads to a situation where transactions that should be processed are skipped, resulting in unchecked growth of the per-flow list. Consequently, this can cause CPU and memory exhaustion as unprocessed transactions are repeatedly rescanned, degrading the performance of the system. This issue has been addressed in version 8.0.6, which is recommended for all users to mitigate the risk.

References