CVE-2026-46352
Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
CVE-2026-46352- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
EUVDEUVD-2026-80940
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
EUVD-2026-80940- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
CVE-2026-46352- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
OSV
Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
CVE-2026-46352- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-46352
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
DEBIAN-CVE-2026-46352- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-46352
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available.
- Record
UBUNTU-CVE-2026-46352- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10885-1 No score
libsuricata8_0_5-8.0.5-1.1 on GA media
These are all security issues fixed in the libsuricata8_0_5-8.0.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10885-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricataDebian:13 |
All versions, plus listed versions 1:7.0.10-11:7.0.10-1+deb13u11:7.0.10-1+deb13u21:7.0.10-1+deb13u31:7.0.10-1+deb13u4 Show 24 moreShow less1:7.0.11-11:7.0.11-1~bpo13+11:8.0.0-1~exp11:8.0.0-1~exp21:8.0.0-1~exp41:8.0.0-1~exp51:8.0.1-11:8.0.1-21:8.0.1-31:8.0.1-3~bpo13+11:8.0.2-11:8.0.2-1~bpo13+11:8.0.3-11:8.0.3-1~bpo13+11:8.0.3-2~exp11:8.0.4-11:8.0.4-1~bpo13+11:8.0.5-11:8.0.5-1~bpo13+11:8.0.6-11:8.0.6-1~bpo13+11:8.0.7-11:8.0.7-1~bpo13+11:8.0.7-2~exp1 |
None known |
suricataDebian:14 |
before 1:8.0.5-1, plus listed versions 1:7.0.10-11:7.0.11-11:7.0.11-1~bpo13+11:8.0.0-1~exp11:8.0.0-1~exp2 Show 14 moreShow less1:8.0.0-1~exp41:8.0.0-1~exp51:8.0.1-11:8.0.1-21:8.0.1-31:8.0.1-3~bpo13+11:8.0.2-11:8.0.2-1~bpo13+11:8.0.3-11:8.0.3-1~bpo13+11:8.0.3-2~exp11:8.0.4-11:8.0.4-1~bpo13+11:8.0.5-1~bpo13+1 |
1:8.0.5-1 |
suricataUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.8-1build12.0.9-12.0.10-12.0.10-22.0.11-13.0-1 |
None known |
suricataUbuntu:18.04:LTS |
All versions, plus listed versions 3.2-2ubuntu3 |
None known |
suricataUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0.4-21:6.0.4-3 |
None known |
suricataUbuntu:24.04:LTS |
All versions, plus listed versions 1:7.0.0-21:7.0.2-11:7.0.2-1build11:7.0.3-1build11:7.0.3-1build3 |
None known |
suricataUbuntu:26.04:LTS |
All versions, plus listed versions 1:7.0.10-11:8.0.1-3build11:8.0.2-11:8.0.2-1build11:8.0.3-1 |
None known |
suricataopenSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 8.0.5-1.1 | 8.0.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46352 is a high vulnerability (CVSS 7.5) in Oisf Suricata, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in suricata 1:8.0.5-1.
References
github.com/OISF/suricata/security/advisories/GHSA-rc34-46x6-mxxm
forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315
redmine.openinfosecfoundation.org/issues/8550
nvd.nist.gov/vuln/detail/CVE-2026-46352
security-tracker.debian.org/tracker/CVE-2026-46352
Show 19 moreShow less
ubuntu.com/security/CVE-2026-46352
cve.org/CVERecord?id=CVE-2026-46352
suse.com/security/cve/CVE-2026-45751