CVE-2026-57225: Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions from 8.0.0 through 8.0.6 are affected when configured to load a JSON or NDJSON dataset with a value_key that resolves to a non-string value.
What does an attacker or malicious feed need to do to trigger the issue?
They need to provide a dataset or rule feed that Suricata loads and that contains a non-string value for the configured value_key. The feed may be trusted or untrusted.
When can the crash occur?
The NULL pointer dereference can crash Suricata during startup, configuration test mode, or a rule reload, before it begins processing traffic.
What can be done if updating is not immediately possible?
Ensure JSON and NDJSON datasets use string values for every field selected by value_key, and do not load feeds that contain non-string values for that key.