CVE Intelligence
Analysis AI-assisted

CVE-2026-22264: Suricata Heap Use-After-Free from Excessive Alert Generation

CVE-2026-22264 affects Suricata, an open-source network IDS, IPS and NSM engine. An unsigned integer overflow can lead to a heap use-after-free when a single packet produces an excessive number of alerts, and versions 7.0.14 and 8.0.3 include a patch. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Suricata is an open-source network IDS, IPS and NSM engine. CVE-2026-22264 is classified as CWE-416 (Use After Free). According to the record, an unsigned integer overflow can lead to a heap use-after-free when the engine generates an excessive number of alerts for a single packet.

Impact

The available data describes a heap use-after-free. The CVSS 3.1 vector in the record marks integrity and availability impact as high and confidentiality impact as none. NVD scores the CVE 9.1, and the GitHub Security Advisories provider lists 7.4 under CVSS 3.1. The practical consequences in a given deployment are not described in the sources consulted.

Affected products and versions

  • Oisf Suricata versions before 7.0.14.
  • Oisf Suricata versions from 8.0.0 up to but not including 8.0.3.

Exploitation status

The CISA KEV catalog entry in the record is marked as not listed. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Suricata to version 8.0.3 or 7.0.14, depending on your release branch. The record links three patch commits.
  • Until the update is applied, the record suggests avoiding untrusted rulesets and running with at least 65536 signatures that can match on the same packet. The record does not explain the rationale for this threshold, so treat it as a temporary measure only.
  • Review the vendor advisory and the linked commits to confirm the fix matches your deployment.

Detection guidance

  • Monitor Suricata for unexpected crashes, restarts or memory-related errors, which may indicate abnormal alert handling.
  • Review alert volume per packet or per flow in your logs and investigate sudden spikes.
  • Track which rulesets are loaded and confirm their source is trusted.

Limitations of the available information

  • The Redmine issue linked in the record is tagged as requiring permissions, so its details could not be reviewed.
  • The record does not describe the exact conditions needed to trigger the overflow or the resulting memory behavior in detail.
  • No EPSS score or SSVC data is present in the record.
  • The two CVSS 3.1 scores (9.1 from NVD and 7.4 from GitHub) differ, and the record does not explain the difference.

Frequently asked questions

Which Suricata versions are affected by CVE-2026-22264?

The record lists versions before 7.0.14 and versions from 8.0.0 up to but not including 8.0.3 as affected.

Which versions contain the fix?

The record states that versions 8.0.3 and 7.0.14 contain a patch.

Is this CVE known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.