Executive brief
Suricata is a network security monitoring engine that detects and prevents intrusions. A flaw in how it tracks IP address pairs allows crafted IPv4 and IPv6 addresses to collide in its internal hash table, causing detection rules to incorrectly apply state from one protocol version to another. This can cause the system to miss real threats or falsely trigger on legitimate traffic.
Technical details
The IPPair hash in src/ippair.c did not verify IP address family (IPv4 vs IPv6) before comparing and reusing cached state, allowing collisions between different address families. This affects xbits tracking, FTP data expectations, and rule-based filtering (thresholding, detection_filter, rate_filter) that use "track by_both" mode. An attacker can craft IPv4/IPv6 address pairs that hash to the same bucket, causing detection state to be misapplied across protocol versions; no authentication or special network position is required, only the ability to send network traffic matching tracked patterns.
Affected products
- OISF Suricata before 7.0.17 and before 8.0.6
Timeline
- 2026-09-18: disclosed: CVE-2026-57222 published
- 2026-09: patched: Fixed in versions 7.0.17 and 8.0.6