PT-2026-4996 · Open Source · Suricata

Ashivb · Publicado 2026-01-01 · Atualizado 2026-01-27 · CVE-2026-22264

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.3 Suricata versions prior to 7.0.14

Description Suricata is a network IDS, IPS and NSM engine. An unsigned integer overflow can lead to a heap use-after-free condition when generating a large number of alerts for a single packet. To mitigate the issue, avoid running untrusted rulesets or running Suricata with less than 65536 signatures that can match on the same packet.

Recommendations Update to Suricata version 8.0.3 or later. Update to Suricata version 7.0.14 or later. Avoid running untrusted rulesets. Run Suricata with at least 65536 signatures that can match on the same packet.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2026-01034

CVE-2026-22264

GHSA-MQR8-M3M4-2HW5

OPENSUSE-SU-2026:10082-1

Produtos afetados

Suricata

Referências · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22264.json · Exploit
• https://github.com/OISF/suricata/security/advisories/GHSA-mqr8-m3m4-2hw5 · Aviso do Fabricante
• https://github.com/OISF/suricata/commit/ac1eb394181530430fb7262969f423a1bf8f209b · Correção
• https://github.com/OISF/suricata/commit/549d7bf60616de8e54686a188196453b5b22f715 · Correção
• https://github.com/OISF/suricata/commit/5789a3d3760dbf33d93fc56c27bd9529e5bdc8f2 · Correção
• https://security-tracker.debian.org/tracker/CVE-2026-22264 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-64333 · Nota
• https://suse.com/security/cve/CVE-2026-22259 · Nota
• https://suse.com/security/cve/CVE-2025-64334 · Nota
• https://osv.dev/vulnerability/CVE-2026-22264 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-22264 · Nota de Segurança
• https://twitter.com/CVEnew/status/2016226147701313593 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-22262 · Nota
• https://suse.com/security/cve/CVE-2026-22264 · Nota
• https://suse.com/security/cve/CVE-2025-64335 · Nota