CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
CVE-2026-45766- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-75767
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
EUVD-2026-75767- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
CVE-2026-45766- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSV
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
CVE-2026-45766- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-45766
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
DEBIAN-CVE-2026-45766- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-45766
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
- Record
UBUNTU-CVE-2026-45766- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10885-1 No score
libsuricata8_0_5-8.0.5-1.1 on GA media
These are all security issues fixed in the libsuricata8_0_5-8.0.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10885-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricataDebian:13 |
All versions, plus listed versions 1:7.0.10-11:7.0.10-1+deb13u11:7.0.10-1+deb13u21:7.0.10-1+deb13u31:7.0.10-1+deb13u4 Show 24 moreShow less1:7.0.11-11:7.0.11-1~bpo13+11:8.0.0-1~exp11:8.0.0-1~exp21:8.0.0-1~exp41:8.0.0-1~exp51:8.0.1-11:8.0.1-21:8.0.1-31:8.0.1-3~bpo13+11:8.0.2-11:8.0.2-1~bpo13+11:8.0.3-11:8.0.3-1~bpo13+11:8.0.3-2~exp11:8.0.4-11:8.0.4-1~bpo13+11:8.0.5-11:8.0.5-1~bpo13+11:8.0.6-11:8.0.6-1~bpo13+11:8.0.7-11:8.0.7-1~bpo13+11:8.0.7-2~exp1 |
None known |
suricataDebian:14 |
before 1:8.0.5-1, plus listed versions 1:7.0.10-11:7.0.11-11:7.0.11-1~bpo13+11:8.0.0-1~exp11:8.0.0-1~exp2 Show 14 moreShow less1:8.0.0-1~exp41:8.0.0-1~exp51:8.0.1-11:8.0.1-21:8.0.1-31:8.0.1-3~bpo13+11:8.0.2-11:8.0.2-1~bpo13+11:8.0.3-11:8.0.3-1~bpo13+11:8.0.3-2~exp11:8.0.4-11:8.0.4-1~bpo13+11:8.0.5-1~bpo13+1 |
1:8.0.5-1 |
suricataUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.8-1build12.0.9-12.0.10-12.0.10-22.0.11-13.0-1 |
None known |
suricataUbuntu:18.04:LTS |
All versions, plus listed versions 3.2-2ubuntu3 |
None known |
suricataUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0.4-21:6.0.4-3 |
None known |
suricataUbuntu:24.04:LTS |
All versions, plus listed versions 1:7.0.0-21:7.0.2-11:7.0.2-1build11:7.0.3-1build11:7.0.3-1build3 |
None known |
suricataUbuntu:26.04:LTS |
All versions, plus listed versions 1:7.0.10-11:8.0.1-3build11:8.0.2-11:8.0.2-1build11:8.0.3-1 |
None known |
suricataopenSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 8.0.5-1.1 | 8.0.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45766 is a high vulnerability (CVSS 7.5) in Oisf Suricata, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in suricata 1:8.0.5-1.
References
github.com/OISF/suricata/security/advisories/GHSA-jqr4-ch38-wvm6
forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315
redmine.openinfosecfoundation.org/issues/8418
nvd.nist.gov/vuln/detail/CVE-2026-45766
security-tracker.debian.org/tracker/CVE-2026-45766
Show 25 moreShow less
ubuntu.com/security/CVE-2026-45766
cve.org/CVERecord?id=CVE-2026-45766
suse.com/security/cve/CVE-2026-45751