Is CVE-2026-57222 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57222 being exploited in the wild.

How severe is CVE-2026-57222?

Medium severity, with a CVSS score of 5.3, published 18 September 2026.

Which products and versions are affected?

OISF Suricata before 7.0.17 and before 8.0.6.

Is there a fix for CVE-2026-57222?

A patch was published on 2026-09: Fixed in versions 7.0.17 and 8.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57222 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-57222?

Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57222: Suricata IPv4/IPv6 address hash collision in IP pair tracking

CVE-2026-57222 · Severity: medium · CVSS 5.3 · Published 2026-09-18

Suricata is a network security monitoring engine that detects and prevents intrusions. A flaw in how it tracks IP address pairs allows crafted IPv4 and IPv6 addresses to collide in its internal hash table, causing detection rules to incorrectly apply state from one protocol version to another. This can cause the system to miss real threats or falsely trigger on legitimate traffic.

Technologies: OISF Suricata. Vendors: OISF.

Quick answers

Is CVE-2026-57222 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57222 being exploited in the wild.
How severe is CVE-2026-57222?: Medium severity, with a CVSS score of 5.3, published 18 September 2026.
Which products and versions are affected?: OISF Suricata before 7.0.17 and before 8.0.6.
Is there a fix for CVE-2026-57222?: A patch was published on 2026-09: Fixed in versions 7.0.17 and 8.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57222 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-57222?: Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The IPPair hash in src/ippair.c did not verify IP address family (IPv4 vs IPv6) before comparing and reusing cached state, allowing collisions between different address families. This affects xbits tracking, FTP data expectations, and rule-based filtering (thresholding, detection_filter, rate_filter) that use "track by_both" mode. An attacker can craft IPv4/IPv6 address pairs that hash to the same bucket, causing detection state to be misapplied across protocol versions; no authentication or special network position is required, only the ability to send network traffic matching tracked patterns.

Affected products

OISF Suricata before 7.0.17 and before 8.0.6

Timeline

2026-09-18: disclosed: CVE-2026-57222 published
2026-09: patched: Fixed in versions 7.0.17 and 8.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.