CVE-2026-45763: Suricata lua: sandbox allocation limit not enforced for new allocations
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5,when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable security.lua.allow-rules unless Lua rules are required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.5 - Configuration
Disable `security.lua.allow-rules` as a workaround unless Lua rules are required, since Lua sandbox memory limit enforcement is unreliable when Lua rule execution is enabled.
Suricata Lua sandbox security.lua.allow-rules = false
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Suricata deployments running version 8.0.0 through versions before 8.0.5 are affected only when Lua rule execution is enabled and an affected Lua script or rule is loaded.
Does an attacker need authentication or user interaction to trigger the impact?
The supplied vector indicates no privileges or user interaction are required, but exploitation has high attack complexity. The issue depends on Lua allocation patterns that bypass the intended sandbox allocation limit.
What should be done if upgrading is not immediately possible?
Disable security.lua.allow-rules unless Lua rules are required. This removes the Lua rule execution condition needed for the issue.
How can I determine whether my configuration is affected?
Check whether Suricata is running a version from 8.0.0 up to, but not including, 8.0.5, whether security.lua.allow-rules is enabled, and whether Lua rules or scripts are loaded. The configured security.lua.max-bytes limit may be unreliable for new allocations under those conditions.