CVE-2026-22261 — Excessive Platform Resource Consumption within a Loop in Suricata

CWE-1050 — Excessive Platform Resource Consumption within a Loop6 documents6 sources

Severity

5.3MEDIUMNVD

CNA3.7

EPSS

0.1%

top 77.04%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oisf Suricata

Timeline

PublishedJan 27

Description

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve configuration. The setting is disabled by default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5oisf/suricata< 7.0.14+1

▶NVDoisf/suricata8.0.0 — 8.0.3+1

▶Debianoisf/suricata< 1:7.0.10-1+deb13u3+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

CVEList

Suricata eve/alert: http1 xff handling can lead to denial of service↗2026-01-27

▶

OSV

CVE-2026-22261: Suricata is a network IDS, IPS and NSM engine↗2026-01-27

▶

📋Vendor Advisories

Red Hat

suricata: Suricata: Denial of Service due to XFF handling inefficiencies↗2026-01-27

▶

Debian

CVE-2026-22261: suricata - Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.1...↗2026

▶

🕵️Threat Intelligence

Wiz

CVE-2026-22261 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶