CVE-2026-45751: Suricata detect/transform: use-after-free in dotprefix transform
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing buffer to be reallocated. The issue is reached during a specific network traffic processing, and requires a specific but not malicious rule. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, avoid rules that chain dotprefix transform after another one.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Compensating control
As a workaround, avoid rules that chain `dotprefix` transform after another one.
Event History
Frequently Asked Questions
Which deployments are exposed?
Suricata versions earlier than 7.0.16 and 8.0.5 are affected when they process the specific traffic and use a rule that chains the dotprefix transform after another transform. The rule is required to reach the issue and does not need to be malicious.
What is the practical impact of successful exploitation?
The vulnerability is a use-after-free condition that can cause an availability impact. The supplied vector indicates no confidentiality or integrity impact.
What should be done if upgrading is not immediately possible?
Avoid rules that chain the dotprefix transform after another transform. Upgrade to Suricata 7.0.16 or 8.0.5 when possible.