CVE-2026-57224: Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::fordirection(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Suricata sensors that observe only one direction of DHCP or RDP traffic are exposed. In that traffic pattern, transactions for the unseen direction cannot be marked inspected and completed transactions are not freed.
What versions require remediation?
The issue affects Suricata versions 8.0.0 through 8.0.5. Version 8.0.6 contains the fix.
What signs indicate that a sensor may be affected?
Affected sensors can show a growing per-flow transaction list, increasing CPU and memory consumption, and eventually denial of service. Cleanup activity repeatedly scanning an expanding transaction list contributes to the resource use.