Executive brief
Suricata is a network security monitoring and intrusion detection system used to monitor and protect network traffic in real-time. A flaw in the Lua scripting engine allows a malicious or misconfigured Lua rule to register excessive flow variables, corrupting the detection state and potentially bypassing Suricata's security sandbox. This can lead to unintended code execution or system crashes, compromising network visibility and availability.
Technical details
The vulnerability is a sandbox bypass and out-of-bounds write (CWE-787, CWE-693) in Suricata's Lua detection engine. A Lua rule that registers an excessive number of flow variables can corrupt the Lua detection state, circumventing the restricted sandbox designed to prevent unsafe operations. This requires loading a malicious or misconfigured Lua script/rule; the attack vector is network-based when such rules are deployed to process network traffic. An attacker can achieve integrity violation (sandbox bypass) and potential denial of service (crash). The vulnerability affects Suricata 8.0.0 through 8.0.4 and is patched in version 8.0.5; a workaround exists by disabling the `security.lua.allow-rules` configuration option.
Affected products
- OISF Suricata 8.0.0 to 8.0.4
Timeline
- 2026-06-02: disclosed
- 2026-05-19: patched: Suricata 8.0.5 released with fix