CVE-2026-45765
published 2026-09-10CVE-2026-45765: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.62%
48.9th percentile
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | < 7.0.16 | 7.0.16 |
| oisf | suricata | — | — |
| oisf | suricata | >= 7.0.0 < 7.0.16 | 7.0.16 |
| oisf | suricata | >= 8.0.0 < 8.0.5 | 8.0.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
vendor_redhat·2026-09-10·CVSS 7.5
CVE-2026-45765 [HIGH] CWE-1284 Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).
A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume exce
VulDB
OISF Suricata up to 7.0.15/8.0.4 DNP3 Reassembly buffer overflow
vuldb·2026-09-11·CVSS 7.5
CVE-2026-45765 [HIGH] OISF Suricata up to 7.0.15/8.0.4 DNP3 Reassembly buffer overflow
A vulnerability was found in OISF Suricata up to 7.0.15/8.0.4. It has been rated as critical. Impacted is an unknown function of the component DNP3 Reassembly. Performing a manipulation results in buffer overflow.
This vulnerability is reported as CVE-2026-45765. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [epel-all]
bugzilla·2026-09-15·CVSS 7.5
CVE-2026-45765 [HIGH] CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [epel-all]
CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define
Bugzilla
CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [fedora-all]
bugzilla·2026-09-15·CVSS 7.5
CVE-2026-45765 [HIGH] CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [fedora-all]
CVE-2026-45765 suricata: Suricata: Denial of Service via unbounded DNP3 reassembly [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or defi
Bugzilla
CVE-2026-45765 Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
bugzilla·2026-09-11·CVSS 7.5
CVE-2026-45765 [HIGH] CVE-2026-45765 Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
CVE-2026-45765 Suricata: Suricata: Denial of Service via unbounded DNP3 reassembly
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).
2026-09-10
Published