CVE-2026-46352CWE-833

CVE-2026-46352

High · published September 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-833 · Deadlock
Published
2026-09-16T23:17Z
Affected products (1)
ProductVersionsFixed in
oisf/suricata≥ 8.0.0, < 8.0.58.0.5
References (3)
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315 · [email protected]https://github.com/OISF/suricata/security/advisories/GHSA-rc34-46x6-mxxm · [email protected]https://redmine.openinfosecfoundation.org/issues/8550 · [email protected]
EPSS history
Timeline
  • 18 SEP 03:59Z
    EPSS moved — → 0%
    epss
  • 16 SEP 18:28Z
    Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
    cvelistv5