# CVE-2026-45752: Suricata use-after-free in decompress transforms

Source: https://junglewise.ai/threats/cve-2026-45752-suricata-use-after-free-in-decompress-transforms  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-45752 · Severity: medium · CVSS 5.9 · Published 2026-09-10

Suricata is a network security monitoring and intrusion detection system used to analyze traffic for threats. A vulnerability in its detection rule processing allows a malicious detection rule to cause the application to crash by triggering a use-after-free memory error, resulting in denial of service and loss of network visibility.

Technologies: [OISF Suricata](https://junglewise.ai/threats/technologies/suricata). Vendors: [OISF](https://junglewise.ai/threats/vendors/oisf).

## Quick answers

**Is CVE-2026-45752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45752 being exploited in the wild.

**How severe is CVE-2026-45752?** Medium severity, with a CVSS score of 5.9, published 10 September 2026.

**Which products and versions are affected?** OISF Suricata 8.0.0 to 8.0.4.

**Is there a fix for CVE-2026-45752?** A patch was published on 2026-05-19: Fix released in Suricata 8.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45752 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45752?** Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability (CWE-416) exists in Suricata's decompress transform pipeline when certain detection transforms are chained together. Specifically, when gunzip or zlib_deflate transforms with max-size larger than 4096 are chained after another transform, the pipeline reads from an inspection buffer after it has been reallocated and freed. The vulnerability is triggered during network traffic processing and requires a malicious detection rule to exploit; it does not depend on specific malicious traffic content. An attacker with the ability to create or inject malicious Suricata detection rules can cause a denial of service by crashing the Suricata process. The issue is fixed in Suricata 8.0.5; a workaround exists by avoiding the vulnerable rule pattern.

## Affected products

- OISF Suricata 8.0.0 to 8.0.4

## Timeline

- 2026-06-02: disclosed
- 2026-05-19: patched: Fix released in Suricata 8.0.5

## References

- [https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315](https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315)
- [https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3](https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3)

## Related threats

- [Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free)
- [Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an)
- [Suricata IP family validation bypass in flow comparison](https://junglewise.ai/threats/cve-2026-71855-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata DNS-over-HTTP/2 buffer memory handling denial of service](https://junglewise.ai/threats/cve-2026-71418-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata HTTP/1 compression bomb denial of service](https://junglewise.ai/threats/cve-2026-63452-suricata-is-a-network-intrusion-detection-system-intrusion)