CVE-2026-57224

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57224
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57224.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57224
Aliases
  • GHSA-m2vc-g65c-ph7m
Downstream
Related
Published
2026-09-18T20:08:46Z
Modified
2026-09-19T11:45:28Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
Details

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57224.json"
}
References

Affected packages

Git / github.com/oisf/suricata

Affected ranges

Type
GIT
Repo
https://github.com/oisf/suricata
Events
Introduced
9956286fb89f9cad9e9f95b99dc751f8666617b7
Fixed
4c28cc1b4ac64f48efdca6ce3e09748227a04a7e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

suricata-8.*
suricata-8.0.0
suricata-8.0.1
suricata-8.0.2
suricata-8.0.3
suricata-8.0.4
suricata-8.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57224.json"