CVE-2026-22262: Suricata: stack overflow in dataset saving
Suricata, a network IDS, IPS and NSM engine, is affected by CVE-2026-22262, a stack overflow in the code that saves datasets when the data is too large. The record lists versions earlier than 7.0.14 and versions from 8.0.0 up to but not including 8.0.3 as affected. Patched versions are 8.0.3 and 7.0.14, and a workaround is to avoid rules that use the dataset save or state options.
Overview
Suricata is a network IDS, IPS and NSM engine. According to the record, CVE-2026-22262 affects the routine that saves a dataset, where a stack buffer is used to prepare the data. When the data in the dataset is too large, a stack overflow can occur. The record classifies the weakness as CWE-787 (Out-of-bounds Write). The GitHub Security Advisory is the vendor advisory cited in the record.
Impact
NVD assigns a base score of 9.8 (critical) with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability, as shown in the NVD entry. The record also lists a score of 5.9 from the CNA, GitHub. The record does not describe the consequences of the overflow beyond the stack overflow itself.
Affected products and versions
- Oisf Suricata versions earlier than 7.0.14.
- Oisf Suricata versions from 8.0.0 up to but not including 8.0.3.
The record states that versions 8.0.3 and 7.0.14 contain the patch. The commits linked in the record identify the code changes.
Exploitation status
The record shows that the vulnerability is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis. No EPSS score is available in the record.
Remediation and mitigation
- Upgrade Suricata to version 8.0.3 or 7.0.14, depending on the branch in use.
- If an immediate upgrade is not possible, follow the workaround in the record: do not use rules with the dataset save or state options.
- Review rule sets and configurations to identify any use of these dataset options before and after applying the change.
Detection guidance
- Inventory all Suricata deployments and record their exact versions.
- Search rule sets for dataset rules that use the save or state options.
- Monitor for unexpected Suricata process crashes or restarts, which may indicate memory corruption, while recognizing that such events have other causes too.
- Confirm the workaround and upgrade status in configuration management records.
Limitations of the available information
The record does not specify the exact size threshold that triggers the overflow, whether data from remote sources can reach that code path, or whether any proof of concept exists. The record notes a Redmine issue marked as requiring permissions, so its details could not be verified. The two scores differ between NVD and the CNA, and the record does not explain the difference.
Frequently asked questions
Is this Suricata vulnerability known to be actively exploited?
The record shows that CVE-2026-22262 is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which Suricata versions contain the fix?
According to the record, versions 8.0.3 and 7.0.14 contain the patch.
What can be done if an upgrade cannot happen right away?
The record suggests not using rules that employ the dataset save or state options, and reviewing rule sets to confirm that these options are no longer in use.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.