PT-2026-4990 · Open Information Security Foundation · Suricata

Victorjulien · Published 2026-01-01 · Updated 2026-01-27 · CVE-2026-22261

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.3 Suricata versions prior to 7.0.14

Description Suricata is a network IDS, IPS and NSM engine. Inefficiencies in extended forwarding format (xff) handling, particularly for alerts that are not triggered within a transaction (tx), can cause significant performance degradation. Disabling XFF support in the eve configuration can serve as a workaround. The setting is disabled by default.

Recommendations Update to Suricata version 8.0.3 or later. Update to Suricata version 7.0.14 or later. Disable XFF support in the eve configuration as a temporary workaround.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-1050

CWE-476

Related Identifiers

BDU:2026-00963

CVE-2026-22261

GHSA-5JVG-5J3P-34CF

OPENSUSE-SU-2026:10082-1

Affected Products

Suricata

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22261.json · Exploit
• https://github.com/OISF/suricata/commit/af246ae7ab1b70c09f83c0619b253095ccc18667 · Patch
• https://github.com/OISF/suricata/commit/3f0725b34c7871c2de4346c8af872f10f4501e44 · Patch
• https://github.com/OISF/suricata/security/advisories/GHSA-5jvg-5j3p-34cf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22261 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22261 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22261 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22261 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00963 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22261 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22261 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10082-1 · Vendor Advisory
• https://github.com/OISF/suricata/commit/3f0725b34c7871c2de4346c8af872f10f4501e44. · Note
• https://suse.com/security/cve/CVE-2026-22262 · Note