CVE-2026-45769: ikev2: unbounded client transform storage can lead to resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like alert ike any any -> any any (sid: 2; flow.pktstoserver: > 256; bypass; noalert;).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.5 - Configuration
Disable IKE application-layer parsing if it is not needed.
Suricata IKE application-layer parsing = disabled if not needed - Compensating control
Use a Suricata bypass rule to bypass IKE flows after the first packets, e.g., `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Suricata deployments using versions earlier than 7.0.16 or 8.0.5 are affected when IKEv2 application-layer parsing is enabled and can receive crafted UDP traffic.
What does an attacker need to exploit the issue?
An attacker can repeatedly send crafted UDP traffic; no privileges or user interaction are required. The traffic causes unbounded storage of client transforms in IKEv2 parser state, consuming excessive memory.
What should be done if upgrading cannot happen immediately?
Disable IKE application-layer parsing if it is not required. Alternatively, add a bypass rule for IKE flows after the first 256 to-server packets: alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;).
Which versions contain the fix?
The issue is fixed in Suricata 7.0.16 and 8.0.5.