CVE catalog

CVE-2026-22259

suricata: CVE-2026-22259

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 25, 2026

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default). Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
DebiansuricatabookwormNot reportedvulnerable
Debiansuricata131:7.0.10-1vulnerable
Debiansuricata131:7.0.10-1+deb13u1vulnerable
Debiansuricata131:7.0.10-1+deb13u2vulnerable
Debiansuricata131:7.0.10-1+deb13u3fixed
Debiansuricata141:7.0.10-1vulnerable
Debiansuricata141:7.0.11-1vulnerable
Debiansuricata141:7.0.11-1~bpo13+1vulnerable
Debiansuricata141:8.0.0-1~exp1vulnerable
Debiansuricata141:8.0.0-1~exp2vulnerable
Debiansuricata141:8.0.0-1~exp4vulnerable
Debiansuricata141:8.0.0-1~exp5vulnerable
Debiansuricata141:8.0.1-1vulnerable
Debiansuricata141:8.0.1-2vulnerable
Debiansuricata141:8.0.1-3vulnerable
Debiansuricata141:8.0.1-3~bpo13+1vulnerable
Debiansuricata141:8.0.2-1vulnerable
Debiansuricata141:8.0.2-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-1fixed
Ubuntusuricata16.042.0.8-1build1vulnerable
Ubuntusuricata16.042.0.9-1vulnerable
Ubuntusuricata16.042.0.10-1vulnerable
Ubuntusuricata16.042.0.10-2vulnerable
Ubuntusuricata16.042.0.11-1vulnerable
Ubuntusuricata16.043.0-1vulnerable
Ubuntusuricata18.043.2-2ubuntu3vulnerable
Ubuntusuricata22.041:6.0.4-2vulnerable
Ubuntusuricata22.041:6.0.4-3vulnerable
Ubuntusuricata24.041:7.0.0-2vulnerable
Ubuntusuricata24.041:7.0.2-1vulnerable
Ubuntusuricata24.041:7.0.2-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build3vulnerable
Ubuntusuricata25.101:7.0.8-2vulnerable
Ubuntusuricata25.101:7.0.10-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansuricatadeb131:7.0.10-1+deb13u3Not reportedDEBIAN-CVE-2026-22259Not reported
Debiansuricatadeb141:8.0.3-1Not reportedDEBIAN-CVE-2026-22259Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [suricata]Affected
    Details (2)

    • 1:7.0.10-1~bpo12+1 · amd64 · bookworm-backports

      Affected

      dsa · suricata · debian · bookworm

    • 1:7.0.10-1~bpo12+1 · arm64 · bookworm-backports

      Affected

      dsa · suricata · debian · bookworm

[Debian 13 (Trixie)]

  • [suricata]Fixed
    Details (4)

    • 1:7.0.10-1+deb13u4 · amd64 · trixie

      Fixed · Fixed: 1:7.0.10-1+deb13u3

      dsa · suricata · debian · 13

    • 1:7.0.10-1+deb13u4 · arm64 · trixie

      Fixed · Fixed: 1:7.0.10-1+deb13u3

      dsa · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1:7.0.10-1+deb13u3

      dsa · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1:7.0.10-1+deb13u3

      dsa · suricata · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]