CVE-2026-71855: Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.17
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions before 7.0.17 and 8.0.6 are affected. The issue applies where IPv4 and IPv6 traffic can be processed such that their flow hash inputs align.
What does an attacker need to do to exploit this?
An attacker must create IPv4 and IPv6 flows whose raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. Successful alignment can cause one packet family to reuse flow state created for the other.
What is the security impact of a successful collision?
A collision can apply incorrect flowbit state to a flow, bypass detection, or trigger an IP-only bypass. The reported impact is integrity-related; no confidentiality or availability impact is stated.
What should be done to remediate the issue?
Upgrade Suricata to version 7.0.17 or 8.0.6, which contain the fix.