Executive brief
Suricata is a network security monitoring and intrusion detection/prevention system used to analyze traffic for threats. The Lua TLS certificate helper function can crash when processing malformed TLS traffic with missing certificate fields, causing the security monitoring engine to stop working and lose visibility of network threats.
Technical details
A null pointer dereference vulnerability (CWE-476) exists in the Lua TLS certificate information helper function (`TlsGetCertInfo`) when processing TLS traffic with absent or malformed certificate fields. The vulnerability is triggered when a Lua script requests certificate information from crafted TLS packets where certain certificate fields are missing, causing the unpatched code to dereference a NULL pointer. This is a network-reachable denial-of-service vector requiring no authentication or user interaction. An attacker can craft malicious TLS traffic to crash Suricata instances running affected Lua scripts, disrupting network security monitoring. Suricata 7.0.16 contains the fix; workarounds include removing Lua TLS certificate inspection on untrusted traffic or updating scripts to safely handle missing fields.
Affected products
- OISF Suricata prior to 7.0.16
Timeline
- 2026-06-02: disclosed
- 2026-09-10: advisory
- 2026-05-19: patched: Suricata 7.0.16 released