CVE-2026-45747: Suricata lua/tls: null dereference in TlsGetCertInfo
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (TlsGetCertInfo function), or update scripts to handle missing certificate fields where possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.16 - Compensating control
Avoid Lua scripts that call the Suricata Lua TLS certificate information helper `TlsGetCertInfo` on untrusted traffic; or update Lua scripts to handle missing certificate fields when requested certificate information is incomplete (where some certificate fields are absent).
Event History
Frequently Asked Questions
Which Suricata deployments are exposed?
Deployments running a version prior to 7.0.16 are affected when they use Lua TLS scripting that requests certificate information through TlsGetCertInfo. Deployments without Lua scripts calling the TLS certificate information helper are not described as exposed.
What does an attacker need to do to trigger the issue?
An attacker needs to send crafted TLS traffic containing absent certificate fields that is processed by an affected Lua TLS script. The provided severity vector indicates no privileges or user interaction are required.
What can be done if upgrading is not immediately possible?
Avoid Lua scripts that call TlsGetCertInfo on untrusted traffic. Where possible, update those scripts to handle missing certificate fields.
How can I identify potentially affected systems?
Check whether Suricata is older than version 7.0.16 and review deployed Lua scripts for calls to TlsGetCertInfo. Systems meeting both conditions should be treated as potentially vulnerable to a crash from crafted TLS traffic.