CVE-2026-57227: Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/src/mqtt/mqtt.rsto a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
rust/src/mqtt/mqtt.rsto a version that resolves this vulnerability.Fixed in 8.0.6 - Compensating control
Until upgraded to a fixed version, mitigate the risk by using Suricata to detect/stop MQTT traffic that contains repeated PUBREC and PUBREL messages characteristic of unbounded resource consumption.
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions 7.0.0 through 7.0.16 are affected, as are 8.0 releases before 8.0.6. Systems running Suricata 7.0.17 or 8.0.6 include the fix.
What does an attacker need to exploit this issue?
An attacker needs to send crafted MQTT traffic containing repeated PUBREC or PUBREL messages. The issue is remotely exploitable and does not require privileges or user interaction.
What is the operational impact?
Repeated messages can cause transaction state to grow without limit, consuming CPU and memory. This can slow Suricata or cause a denial of service.
How can I determine whether I need to remediate?
Check the installed Suricata version. Remediate if it is in the affected 7.0.0–7.0.16 range or is an 8.0 release earlier than 8.0.6.