CVE-2026-45766CWE-400CWE-770denial-of-service

CVE-2026-45766

High · published September 11, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00616 · 48.9th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-11T02:16Z
Affected products (2)
ProductVersionsFixed in
oisf/suricata≥ 7.0.0, < 7.0.167.0.16
oisf/suricata≥ 8.0.0, < 8.0.58.0.5
References (3)
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 · [email protected]https://github.com/OISF/suricata/security/advisories/GHSA-jqr4-ch38-wvm6 · [email protected]https://redmine.openinfosecfoundation.org/issues/8418 · [email protected]
EPSS history
Timeline
  • 12 SEP 03:21Z
    EPSS moved — → 0%
    epss
  • 10 SEP 21:26Z
    Suricata nfs: unbounded stateful structures can lead to resource exhaustion
    cvelistv5