CVE-2026-57229: Suricata smtp/mime: incomplete state reset allows detection bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions 8.0.0 through 8.0.5 are affected when SMTP MIME decoding is enabled. The issue affects detections that rely on file.data, file.name, or extracted URLs.
What does an attacker need to do to evade detection?
An attacker needs to send a crafted SMTP message using Content-Type: message/rfc822 encapsulation. The crafted structure can cause encoding or filename state from an outer MIME part to leak into the inner message.
What should be done if upgrading cannot happen immediately?
The provided data identifies version 8.0.6 as the fix. No alternative mitigation or configuration workaround is provided.