CVE-2026-45769

High

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.

SeverityHigh

CVSS7.5

Exploit probability—

ProductOisf Suricata

PublishedSep 10, 2026

First seenSep 10, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-770Allocation of resources without limits

How to fix

Update

oisf suricata7.0.16, 8.0.5 or later

Affected products

Product	Affected versions	Fixed in
oisf suricata	7.0.0 ≤ v < 7.0.16, 8.0.0 ≤ v < 8.0.5	7.0.16, 8.0.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.