Is CVE-2026-45770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45770 being exploited in the wild.

How severe is CVE-2026-45770?

High severity, with a CVSS score of 7.5, published 10 September 2026.

Is there a fix for CVE-2026-45770?

A patch was published on 2026-05-19: Suricata 8.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45770 attacked?

It is attacked over the network.

Am I affected by CVE-2026-45770?

Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45770: Suricata Lua sandbox bypass via excessive flow variables

CVE-2026-45770 · Severity: high · CVSS 7.5 · Published 2026-09-10

Suricata is a network security monitoring and intrusion detection system used to monitor and protect network traffic in real-time. A flaw in the Lua scripting engine allows a malicious or misconfigured Lua rule to register excessive flow variables, corrupting the detection state and potentially bypassing Suricata's security sandbox. This can lead to unintended code execution or system crashes, compromising network visibility and availability.

Technologies: OISF Suricata. Vendors: OISF.

Quick answers

Is CVE-2026-45770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45770 being exploited in the wild.
How severe is CVE-2026-45770?: High severity, with a CVSS score of 7.5, published 10 September 2026.
Which products and versions are affected?: OISF Suricata 8.0.0 to 8.0.4.
Is there a fix for CVE-2026-45770?: A patch was published on 2026-05-19: Suricata 8.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45770 attacked?: It is attacked over the network.
Am I affected by CVE-2026-45770?: Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a sandbox bypass and out-of-bounds write (CWE-787, CWE-693) in Suricata's Lua detection engine. A Lua rule that registers an excessive number of flow variables can corrupt the Lua detection state, circumventing the restricted sandbox designed to prevent unsafe operations. This requires loading a malicious or misconfigured Lua script/rule; the attack vector is network-based when such rules are deployed to process network traffic. An attacker can achieve integrity violation (sandbox bypass) and potential denial of service (crash). The vulnerability affects Suricata 8.0.0 through 8.0.4 and is patched in version 8.0.5; a workaround exists by disabling the `security.lua.allow-rules` configuration option.

Affected products

OISF Suricata 8.0.0 to 8.0.4

Timeline

2026-06-02: disclosed
2026-05-19: patched: Suricata 8.0.5 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.