# CVE-2026-45765: Suricata DNP3 unbounded reassembly denial of service

Source: https://junglewise.ai/threats/cve-2026-45765-suricata-dnp3-unbounded-reassembly-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-45765 · Severity: high · CVSS 7.5 · Published 2026-09-10

Suricata is a network security monitoring engine used to detect and prevent intrusions. A flaw in its DNP3 protocol parser allows attackers to send specially crafted network traffic that causes excessive memory consumption, potentially crashing the Suricata service and disrupting security monitoring for the protected network.

Technologies: [OISF Suricata](https://junglewise.ai/threats/technologies/suricata). Vendors: [OISF](https://junglewise.ai/threats/vendors/oisf).

## Quick answers

**Is CVE-2026-45765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45765 being exploited in the wild.

**How severe is CVE-2026-45765?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** OISF Suricata before 7.0.16 and 8.0.5.

**Is there a fix for CVE-2026-45765?** A patch was published on 2026-05-19: Suricata 7.0.16 and 8.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45765 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45765?** Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion issue (CWE-400/CWE-770) in Suricata's DNP3 reassembly module. The parser does not enforce sufficient bounds on buffered reassembly data, allowing an attacker to craft malicious DNP3 traffic that consumes excessive memory without limits. The attack is network-reachable with no authentication required, triggered via specially crafted packets sent to a Suricata instance with DNP3 monitoring enabled. Successful exploitation results in denial of service through memory exhaustion and potential process crash. The vulnerability is fixed in Suricata 7.0.16 and 8.0.5; as a workaround, users can disable DNP3 parsing or configure a limited stream.reassembly.depth setting.

## Affected products

- OISF Suricata before 7.0.16 and 8.0.5

## Timeline

- 2026-06-02: disclosed: GitHub security advisory GHSA-m8x4-c78g-r4vj published
- 2026-05-19: patched: Suricata 7.0.16 and 8.0.5 released with fix
- 2026-09-10: advisory: CVE-2026-45765 published on NVD

## References

- [https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315](https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315)
- [https://github.com/OISF/suricata/security/advisories/GHSA-m8x4-c78g-r4vj](https://github.com/OISF/suricata/security/advisories/GHSA-m8x4-c78g-r4vj)

## Related threats

- [Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free)
- [Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an)
- [Suricata IP family validation bypass in flow comparison](https://junglewise.ai/threats/cve-2026-71855-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata DNS-over-HTTP/2 buffer memory handling denial of service](https://junglewise.ai/threats/cve-2026-71418-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata HTTP/1 compression bomb denial of service](https://junglewise.ai/threats/cve-2026-63452-suricata-is-a-network-intrusion-detection-system-intrusion)