Executive brief
Suricata is a network security monitoring engine that detects and prevents intrusions. In versions 8.0.0 through 8.0.5, the DHCP and RDP protocol parsers fail to properly track transaction direction, causing completed transactions to remain in memory indefinitely. An attacker can exploit this by sending specially crafted DHCP or RDP traffic to a Suricata sensor to exhaust CPU and memory resources, rendering the sensor inoperative and disabling network security monitoring.
Technical details
The DHCP and RDP parsers in Suricata create transaction objects but fail to call AppLayerTxData::for_direction() to mark the direction, preventing proper transaction cleanup. This allows the per-flow transaction list to grow unbounded, and cleanup routines repeatedly scan the list consuming increasing CPU and memory. An attacker on the network can send malformed DHCP or RDP packets to trigger transaction accumulation and cause denial of service; no authentication or user interaction is required.
Affected products
- OISF Suricata 8.0.0 through 8.0.5
Timeline
- 2026-09-18: disclosed: CVE-2026-57224 published
- 2026-09-18: patched: Fix available in version 8.0.6