Executive brief
Suricata is a network security monitoring engine used to detect and prevent intrusions. A flaw in its DNP3 protocol parser allows attackers to send specially crafted network traffic that causes excessive memory consumption, potentially crashing the Suricata service and disrupting security monitoring for the protected network.
Technical details
The vulnerability is a resource exhaustion issue (CWE-400/CWE-770) in Suricata's DNP3 reassembly module. The parser does not enforce sufficient bounds on buffered reassembly data, allowing an attacker to craft malicious DNP3 traffic that consumes excessive memory without limits. The attack is network-reachable with no authentication required, triggered via specially crafted packets sent to a Suricata instance with DNP3 monitoring enabled. Successful exploitation results in denial of service through memory exhaustion and potential process crash. The vulnerability is fixed in Suricata 7.0.16 and 8.0.5; as a workaround, users can disable DNP3 parsing or configure a limited stream.reassembly.depth setting.
Affected products
- OISF Suricata before 7.0.16 and 8.0.5
Timeline
- 2026-06-02: disclosed: GitHub security advisory GHSA-m8x4-c78g-r4vj published
- 2026-05-19: patched: Suricata 7.0.16 and 8.0.5 released with fix
- 2026-09-10: advisory: CVE-2026-45765 published on NVD