# CVE-2026-57224: Suricata DHCP and RDP parser transaction leak causing DoS

Source: https://junglewise.ai/threats/cve-2026-57224-suricata-is-a-network-intrusion-detection-system-intrusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57224 · Severity: medium · CVSS 6.5 · Published 2026-09-18

Suricata is a network security monitoring engine that detects and prevents intrusions. In versions 8.0.0 through 8.0.5, the DHCP and RDP protocol parsers fail to properly track transaction direction, causing completed transactions to remain in memory indefinitely. An attacker can exploit this by sending specially crafted DHCP or RDP traffic to a Suricata sensor to exhaust CPU and memory resources, rendering the sensor inoperative and disabling network security monitoring.

Technologies: [OISF Suricata](https://junglewise.ai/threats/technologies/suricata). Vendors: [OISF](https://junglewise.ai/threats/vendors/oisf).

## Quick answers

**Is CVE-2026-57224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57224 being exploited in the wild.

**How severe is CVE-2026-57224?** Medium severity, with a CVSS score of 6.5, published 18 September 2026.

**Which products and versions are affected?** OISF Suricata 8.0.0 through 8.0.5.

**Is there a fix for CVE-2026-57224?** A patch was published on 2026-09-18: Fix available in version 8.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57224 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57224?** Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DHCP and RDP parsers in Suricata create transaction objects but fail to call AppLayerTxData::for_direction() to mark the direction, preventing proper transaction cleanup. This allows the per-flow transaction list to grow unbounded, and cleanup routines repeatedly scan the list consuming increasing CPU and memory. An attacker on the network can send malformed DHCP or RDP packets to trigger transaction accumulation and cause denial of service; no authentication or user interaction is required.

## Affected products

- OISF Suricata 8.0.0 through 8.0.5

## Timeline

- 2026-09-18: disclosed: CVE-2026-57224 published
- 2026-09-18: patched: Fix available in version 8.0.6

## References

- [https://github.com/OISF/suricata/commit/3f86c56c800392ede5cfaf7a944a431fd8445c55](https://github.com/OISF/suricata/commit/3f86c56c800392ede5cfaf7a944a431fd8445c55)
- [https://github.com/OISF/suricata/commit/5af13e3eb06be0387da8703b611c5ce932245c59](https://github.com/OISF/suricata/commit/5af13e3eb06be0387da8703b611c5ce932245c59)

## Related threats

- [Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free)
- [Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an)
- [Suricata IP family validation bypass in flow comparison](https://junglewise.ai/threats/cve-2026-71855-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata DNS-over-HTTP/2 buffer memory handling denial of service](https://junglewise.ai/threats/cve-2026-71418-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata HTTP/1 compression bomb denial of service](https://junglewise.ai/threats/cve-2026-63452-suricata-is-a-network-intrusion-detection-system-intrusion)