CVE-2026-45762: Suricata defrag: missing address-family check can lead to remote crash
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AFPACKET, enabling AFPACKET's defrag option may prevent Suricata from seeing such fragmented packets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Configuration
If using Suricata as an IDS with AF_PACKET, enable AF_PACKET's `defrag` option to help prevent Suricata from missing such fragmented packets (workaround).
Suricata (AF_PACKET) defrag = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Suricata deployments processing crafted fragmented IPv4 and IPv6 traffic are exposed in versions before 7.0.16 and 8.0.5. Exploitation does not require privileges or user interaction and can cause a denial of service through a remote packet-triggered crash.
What should be done if an immediate upgrade is not possible?
For Suricata used as an IDS with AF_PACKET, enabling AF_PACKET's defrag option may prevent Suricata from seeing the fragmented packets that trigger the issue. This workaround is specifically described for IDS deployments using AF_PACKET.
How can I determine whether my deployment is fixed?
The fix is present in Suricata 7.0.16 and 8.0.5. Deployments running an earlier version are affected according to the advisory.