Quick answers
- Is CVE-2026-45752 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45752 being exploited in the wild.
- How severe is CVE-2026-45752?
- Medium severity, with a CVSS score of 5.9, published 10 September 2026.
- Which products and versions are affected?
- OISF Suricata 8.0.0 to 8.0.4.
- Is there a fix for CVE-2026-45752?
- A patch was published on 2026-05-19: Fix released in Suricata 8.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45752 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-45752?
- Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free vulnerability (CWE-416) exists in Suricata's decompress transform pipeline when certain detection transforms are chained together. Specifically, when gunzip or zlib_deflate transforms with max-size larger than 4096 are chained after another transform, the pipeline reads from an inspection buffer after it has been reallocated and freed. The vulnerability is triggered during network traffic processing and requires a malicious detection rule to exploit; it does not depend on specific malicious traffic content. An attacker with the ability to create or inject malicious Suricata detection rules can cause a denial of service by crashing the Suricata process. The issue is fixed in Suricata 8.0.5; a workaround exists by avoiding the vulnerable rule pattern.
Affected products
- OISF Suricata 8.0.0 to 8.0.4
Timeline
- 2026-06-02: disclosed
- 2026-05-19: patched: Fix released in Suricata 8.0.5