CVE-2026-63451: Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to supply or cause Suricata to load a crafted local detection rule. Network traffic alone cannot trigger the flaw.
Are standard traffic-processing deployments exposed?
The vulnerable path is reached while loading a specially crafted rule, including when Suricata is run in test mode. Deployments that do not load untrusted or attacker-controlled rule files are not exposed through network traffic.
What is the impact of a successful exploit?
Loading the crafted rule can cause a heap buffer overflow and crash Suricata, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What versions should be remediated?
The issue affects Suricata from 8.0.0 through 8.0.6. Update to the fixed 8.0.6 version and restrict who can add or modify detection rules.