CVE-2026-57226: Suricata swf: heap buffer overflow in SWF decompression depth handling
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suricatato a version that resolves this vulnerability.Fixed in 8.0.6 - Upgrade
Upgrade
suricatato a version that resolves this vulnerability.Fixed in 7.0.17
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only deployments that enable the non-default swf-decompression feature and configure an unsafe decompress-depth are affected. The default disabled feature and default depth are not affected.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to cause Suricata to process a crafted SWF file delivered in an HTTP response. No attacker privileges or user interaction are required, but exploitation depends on the vulnerable SWF decompression configuration being enabled.
What is the expected impact?
A crafted response can trigger an integer-related heap buffer overflow that crashes Suricata, resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.
How can exposure be reduced before upgrading?
Disable the swf-decompression feature or ensure decompress-depth is not set to an unsafe value. The issue is fixed in Suricata 7.0.17 and 8.0.6.