CVE-2026-45769
published 2026-09-10CVE-2026-45769: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.79%
78.2th percentile
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | < 7.0.16 | 7.0.16 |
| oisf | suricata | — | — |
| oisf | suricata | >= 7.0.0 < 7.0.16 | 7.0.16 |
| oisf | suricata | >= 8.0.0 < 8.0.5 | 8.0.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
suricata: Suricata: Denial of Service via unbounded IKEv2 parser state
vendor_redhat·2026-09-10·CVSS 7.5
CVE-2026-45769 [HIGH] CWE-770 suricata: Suricata: Denial of Service via unbounded IKEv2 parser state
suricata: Suricata: Denial of Service via unbounded IKEv2 parser state
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusio
VulDB
OISF Suricata up to 7.0.15/8.0.4 IKEv2 Parser resource consumption
vuldb·2026-09-11·CVSS 7.5
CVE-2026-45769 [HIGH] OISF Suricata up to 7.0.15/8.0.4 IKEv2 Parser resource consumption
A vulnerability described as critical has been identified in OISF Suricata up to 7.0.15/8.0.4. Affected by this issue is some unknown functionality of the component IKEv2 Parser. Such manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-45769. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
2026-09-10
Published