CVE-2026-31931
published 2026-04-02CVE-2026-31931: Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.35%
27.0th percentile
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | suricata | < suricata 1:8.0.4-1 (forky) | suricata 1:8.0.4-1 (forky) |
| oisf | suricata | — | — |
| oisf | suricata | >= 0 < 1:8.0.4-1 | 1:8.0.4-1 |
| oisf | suricata | >= 8.0.0 < 8.0.4 | 8.0.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-31931: (Suricata is a network IDS, IPS and NSM engine
osv·2026-04-03·CVSS 7.5
CVE-2026-31931 [HIGH] CVE-2026-31931: (Suricata is a network IDS, IPS and NSM engine
(Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to b ...)
OSV
CVE-2026-31931: Suricata is a network IDS, IPS and NSM engine
osv·2026-04-02·CVSS 7.5
CVE-2026-31931 [HIGH] CVE-2026-31931: Suricata is a network IDS, IPS and NSM engine
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
Red Hat
Suricata: Suricata: Denial of Service via 'tls.alpn' rule keyword
vendor_redhat·2026-04-02·CVSS 7.5
CVE-2026-31931 [HIGH] CWE-476 Suricata: Suricata: Denial of Service via 'tls.alpn' rule keyword
Suricata: Suricata: Denial of Service via 'tls.alpn' rule keyword
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. An attacker could trigger a null dereference by using the "tls.alpn" rule keyword, causing the Suricata engine to crash. This vulnerability leads to a Denial of Service (DoS).
Statement: Important: Suricata is vulnerable to a denial of service when processing network traffic with rules that utilize the `tls.alpn` keyword. An attacker can trigger a n
Debian
CVE-2026-31931: suricata - Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before vers...
vendor_debian·2026·CVSS 7.5
CVE-2026-31931 [HIGH] CVE-2026-31931: suricata - Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before vers...
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1:8.0.4-1)
sid: resolved (fixed in 1:8.0.4-1)
trixie: open
No detection rules found.
No public exploits indexed.
2026-04-02
Published