CVE-2026-71855CWE-697

CVE-2026-71855

Medium · published September 19, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2026-09-19T01:18Z
Affected products (2)
ProductVersionsFixed in
oisf/suricata< 7.0.177.0.17
oisf/suricata≥ 8.0.0, < 8.0.68.0.6
References (7)
https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f · [email protected]https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701 · [email protected]https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20 · [email protected]https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 · [email protected]https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 · [email protected]https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586 · [email protected]https://redmine.openinfosecfoundation.org/issues/8558 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 18 SEP 20:25Z
    Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
    cvelistv5