CVE-2026-45770: Suricata lua: excessive flow variable registration can bypass sandbox
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable security.lua.allow-rules unless Lua rules are required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Configuration
As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Suricata (Lua engine) security.lua.allow-rules = false - Compensating control
If Lua scripts/rules are not required, avoid loading affected Lua rules/scripts, because the bypass may require an affected Lua script/rule to be loaded.
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions starting with 8.0.0 and before 8.0.5 are affected when an affected Lua script or rule is loaded. Deployments that do not load Lua rules are not exposed through this issue.
What must an attacker control or provide to exploit this?
An affected Lua script or rule must be loaded, and it must register an excessive number of flow variables. The issue can corrupt Lua detection state, potentially bypassing the restricted Lua sandbox.
Can this cause an availability impact as well as a sandbox bypass?
Yes. Registering excessive flow variables may also cause Suricata to crash.
What should be done if upgrading is not immediately possible?
Disable security.lua.allow-rules unless Lua rules are required. This prevents Lua rules from being loaded as a workaround.
What version fixes the issue?
Version 8.0.5 contains the fix.