CVE-2026-45768: Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

Q: Which deployments are affected?

Suricata versions starting with 8.0.0 and before 8.0.5 are affected when LDAP application-layer parsing is in use. The issue is particularly relevant because LDAP traffic can be processed over UDP.

Q: What does an attacker need to do to trigger the issue?

An attacker can send crafted LDAP traffic that causes a transaction to accumulate an unbounded number of responses. This can drive excessive memory consumption and potentially deny service.

Q: What should I do if I cannot immediately upgrade?

Disable LDAP application-layer parsing where it is not required. Alternatively, deploy a rule such as `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)` to bypass LDAP transactions with more than 1024 responses.

Published Sep 10, 2026

Updated

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;).

Affected Software

1 affected component

Suricata Suricata>=8.0.0<8.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Suricata ldap to a version that resolves this vulnerability.
Fixed in 8.0.5
Configuration
Disable LDAP application-layer parsing where it is not required, as a workaround to prevent Suricata from consuming excessive memory when processing crafted LDAP traffic over UDP.
Suricata LDAP application-layer parsing = disabled

Event History

Sep 10, 2026

CVE Published

via MITRE·09:37 PM

Data Sourced

via MITRE·09:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Suricata versions starting with 8.0.0 and before 8.0.5 are affected when LDAP application-layer parsing is in use. The issue is particularly relevant because LDAP traffic can be processed over UDP.

What does an attacker need to do to trigger the issue?

An attacker can send crafted LDAP traffic that causes a transaction to accumulate an unbounded number of responses. This can drive excessive memory consumption and potentially deny service.

What should I do if I cannot immediately upgrade?

Disable LDAP application-layer parsing where it is not required. Alternatively, deploy a rule such as `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)` to bypass LDAP transactions with more than 1024 responses.

Which version fixes the issue?

Version 8.0.5 contains the fix.