Executive brief
Suricata is a network security monitoring and intrusion detection system used to protect enterprise networks by analyzing traffic. A use-after-free memory vulnerability in the dotprefix transform could allow an attacker to trigger a denial of service by crafting specific network traffic processed by rules that chain transforms, causing the service to crash and disrupting security monitoring visibility.
Technical details
The vulnerability is a use-after-free (CWE-416) in Suricata's inspection-buffer helper when processing chained transforms, specifically when the dotprefix transform follows another transform. When a chained transform causes the backing buffer to be reallocated, an inspection pointer can be left referencing freed memory. The issue is triggered by specific network traffic processed against a rule using the vulnerable transform chain pattern. Attack requires network-reachable Suricata instance with rules containing chained dotprefix transforms; no authentication or user interaction is required. An attacker can cause denial of service by crashing the detection engine. Versions 7.0.16 and 8.0.5 contain the fix; users can workaround by avoiding chained dotprefix transforms in rules.
Affected products
- OISF Suricata prior to 7.0.16 and 8.0.5
Timeline
- 2026-09-10: disclosed
- 2026-05-19: patched: Suricata 7.0.16 and 8.0.5 released