CVE-2026-57228: Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.17
Event History
Frequently Asked Questions
Which deployments are exposed?
Suricata deployments processing SMTP traffic are exposed when decode-quoted-printable MIME decoding is enabled. The affected range is 7.0.13 through 7.0.16; version 7.0.17 contains the fix.
What does an attacker need to exploit this issue?
An attacker only needs to send crafted SMTP traffic that causes a quoted-printable escape sequence to be split across traffic chunks, with the following chunk containing exactly one byte. No authentication or user interaction is required.
What is the likely operational impact?
The out-of-bounds read can crash Suricata, causing a denial of service. The provided information does not indicate data modification or disclosure beyond the one-byte read.
What can be done before upgrading?
If upgrading to 7.0.17 is not immediately possible, disable decode-quoted-printable MIME decoding where operationally acceptable. This removes the feature condition required for the described crash trigger.