# OISF Suricata vulnerabilities Source: https://junglewise.ai/threats/technologies/suricata Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/suricata.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in OISF Suricata: 0 in the last 7 days and 30 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94084, was published on 20 September 2026. Nothing in the last four weeks, down from 15 vulnerabilities in the four before. 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 30 - All time: 45 (3 critical, 0 exploited in the wild) ## About OISF Suricata Suricata is an open-source network threat detection engine that provides intrusion detection, intrusion prevention, and network security monitoring. ## Latest OISF Suricata vulnerabilities - [CVE-2026-94084: Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free) (critical, CVSS 9.4, published 20 Sep 2026) - [CVE-2026-94083: Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an) (critical, CVSS 9.4, published 20 Sep 2026) - [CVE-2026-71855: Suricata IP family validation bypass in flow comparison](https://junglewise.ai/threats/cve-2026-71855-suricata-is-a-network-intrusion-detection-system-intrusion) (medium, CVSS 5.9, published 18 Sep 2026) - [CVE-2026-71418: Suricata DNS-over-HTTP/2 buffer memory handling denial of service](https://junglewise.ai/threats/cve-2026-71418-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-63452: Suricata HTTP/1 compression bomb denial of service](https://junglewise.ai/threats/cve-2026-63452-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-63448: Suricata SMB parser unbounded transaction accumulation DoS](https://junglewise.ai/threats/cve-2026-63448-suricata-is-a-network-intrusion-detection-system-intrusion) (medium, CVSS 5.9, published 18 Sep 2026) - [CVE-2026-63447: Suricata FTP parser denial of service via transaction limit bypass](https://junglewise.ai/threats/cve-2026-63447-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-63446: Suricata inverted flag logic in transaction cleanup](https://junglewise.ai/threats/cve-2026-63446-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-57229: Suricata SMTP MIME parser state reset flaw](https://junglewise.ai/threats/cve-2026-57229-suricata-is-a-network-intrusion-detection-system-intrusion) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-57228: Suricata out-of-bounds read in MIME quoted-printable decoder](https://junglewise.ai/threats/cve-2026-57228-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 8.2, published 18 Sep 2026) - [CVE-2026-57227: Suricata MQTT parser resource exhaustion in transaction handling](https://junglewise.ai/threats/cve-2026-57227-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-57223: Suricata unquoted service path privilege escalation on Windows](https://junglewise.ai/threats/cve-2026-57223-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7, published 18 Sep 2026) - [CVE-2026-57224: Suricata DHCP and RDP parser transaction leak causing DoS](https://junglewise.ai/threats/cve-2026-57224-suricata-is-a-network-intrusion-detection-system-intrusion) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-57222: Suricata IPv4/IPv6 address hash collision in IP pair tracking](https://junglewise.ai/threats/cve-2026-57222-suricata-is-a-network-intrusion-detection-system-intrusion) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-46352: Suricata IP defragmentation deadlock with encapsulated tunnel traffic](https://junglewise.ai/threats/cve-2026-46352-suricata-ip-defragmentation-deadlock-with-encapsulated-tunnel) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-45770: Suricata Lua sandbox bypass via excessive flow variables](https://junglewise.ai/threats/cve-2026-45770-suricata-lua-sandbox-bypass-via-excessive-flow-variables) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45769: Suricata IKEv2 parser unbounded memory consumption](https://junglewise.ai/threats/cve-2026-45769-suricata-ikev2-parser-unbounded-memory-consumption) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45768: Suricata unbounded LDAP response buffering denial of service](https://junglewise.ai/threats/cve-2026-45768-suricata-unbounded-ldap-response-buffering-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45767: Suricata path traversal in rule load/save command](https://junglewise.ai/threats/cve-2026-45767-suricata-path-traversal-in-rule-load-save-command) (medium, CVSS 4.4, published 10 Sep 2026) - [CVE-2026-45766: Suricata NFS parser unbounded state memory exhaustion](https://junglewise.ai/threats/cve-2026-45766-suricata-nfs-parser-unbounded-state-memory-exhaustion) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45765: Suricata DNP3 unbounded reassembly denial of service](https://junglewise.ai/threats/cve-2026-45765-suricata-dnp3-unbounded-reassembly-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45764: Suricata HTTP/2 type confusion denial of service](https://junglewise.ai/threats/cve-2026-45764-suricata-http-2-type-confusion-denial-of-service) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-45762: Suricata IP defragmentation denial of service](https://junglewise.ai/threats/cve-2026-45762-suricata-ip-defragmentation-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45761: Suricata heap buffer overflow in rule parsing](https://junglewise.ai/threats/cve-2026-45761-suricata-heap-buffer-overflow-in-rule-parsing) (low, CVSS 3.3, published 10 Sep 2026) - [CVE-2026-45759: Suricata HTTP Content-Disposition denial of service](https://junglewise.ai/threats/cve-2026-45759-suricata-http-content-disposition-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) ## Most severe OISF Suricata vulnerabilities - [CVE-2026-94084: Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free) (critical, CVSS 9.4, published 20 Sep 2026) - [CVE-2026-94083: Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an) (critical, CVSS 9.4, published 20 Sep 2026) - [CVE-2026-45764: Suricata HTTP/2 type confusion denial of service](https://junglewise.ai/threats/cve-2026-45764-suricata-http-2-type-confusion-denial-of-service) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-57228: Suricata out-of-bounds read in MIME quoted-printable decoder](https://junglewise.ai/threats/cve-2026-57228-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 8.2, published 18 Sep 2026) - [CVE-2026-45769: Suricata IKEv2 parser unbounded memory consumption](https://junglewise.ai/threats/cve-2026-45769-suricata-ikev2-parser-unbounded-memory-consumption) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-45759: Suricata HTTP Content-Disposition denial of service](https://junglewise.ai/threats/cve-2026-45759-suricata-http-content-disposition-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-46387: Suricata HTTP/2 decompression denial of service](https://junglewise.ai/threats/cve-2026-46387-suricata-http-2-decompression-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-57227: Suricata MQTT parser resource exhaustion in transaction handling](https://junglewise.ai/threats/cve-2026-57227-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-45768: Suricata unbounded LDAP response buffering denial of service](https://junglewise.ai/threats/cve-2026-45768-suricata-unbounded-ldap-response-buffering-denial-of-service) (high, CVSS 7.5, published 10 Sep 2026) - [CVE-2026-63446: Suricata inverted flag logic in transaction cleanup](https://junglewise.ai/threats/cve-2026-63446-suricata-is-a-network-intrusion-detection-system-intrusion) (high, CVSS 7.5, published 18 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 15 vulnerabilities in the four before. 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 15 | 1 | 0 | | 14 Sep 2026 | 15 | 2 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OISF Suricata vulnerabilities", https://junglewise.ai/threats/technologies/suricata, 9 November 2026.