CVE-2026-22258: Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the stream.reassembly.depth setting will limit the amount of data that can be buffered. For DCERPC/SMB, the stream.reassembly.depth can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22258?
CVE-2026-22258 is considered a high severity vulnerability due to its potential to cause memory exhaustion in Suricata.
How do I fix CVE-2026-22258?
To resolve CVE-2026-22258, upgrade Suricata to version 8.0.3 or later, or 7.0.14 or later.
What type of vulnerability is CVE-2026-22258?
CVE-2026-22258 is categorized as an unbounded fragment buffering flaw that can lead to memory exhaustion.
Which versions of Suricata are affected by CVE-2026-22258?
Suricata versions prior to 8.0.3 and 7.0.14 are affected by CVE-2026-22258.
What can happen if CVE-2026-22258 is exploited?
If exploited, CVE-2026-22258 can lead to memory exhaustion, potentially causing the Suricata process to be killed.