← Vulnerability feed

Vulnerability record · CVE-2026-22262 · published 27 January 2026

CVE-2026-22262: Oisf suricata stack-based buffer overflow vulnerability

Oisf · Suricata

Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too large, this can result in a stack overflow. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not use rules with datasets `save` nor `state` options.

9.8 CVSS 3.1 Critical EPSS 0.55% · top 56.4% CWE-121 · Stack-based buffer overflowCWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too large, this can result in a stack overflow. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not use rules with datasets `save` nor `state` options.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OISF/suricata/commit/0eff24213763c2aa2bb0957901d5dc1e18414dbf Patch
https://github.com/OISF/suricata/commit/27a2180bceaa3477419c78c54fce364398d011f1 Patch
https://github.com/OISF/suricata/commit/32609e6896f9079c175665a94005417cec7637eb Patch
https://github.com/OISF/suricata/commit/32a1b9ae6aa80a60c073897e38a2ac6ea0f64521 Patch
https://github.com/OISF/suricata/commit/d6bc718e303ecbec5999066b8bc88eeeca743658 Patch
https://github.com/OISF/suricata/commit/d767dfadcd166f82683757818b9e46943326ac90 Patch
https://github.com/OISF/suricata/security/advisories/GHSA-9qg5-2gwh-xp86 Vendor Advisory
https://redmine.openinfosecfoundation.org/issues/8110 Permissions Required

Track CVE-2026-22262 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-35853Oisf suricata code injection vulnerabilityIn Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by …EPSS 1.0%9.8CVE-2021-37592Oisf suricata out-of-bounds write vulnerabilitySuricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments.EPSS 1.6%9.8CVE-2018-10244Oisf suricata integer overflow vulnerabilitySuricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated…EPSS 1.7%9.1CVE-2026-45764Oisf suricata type confusion vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.…EPSS 0.63%9.1CVE-2026-22264Oisf suricata use after free vulnerabilitySuricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free cond…EPSS 0.40%9.1CVE-2019-18792Oisf suricata interpretation conflict vulnerabilityAn issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet…EPSS 2.5%8.1CVE-2024-23839Oisf suricata use after free vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially craft…EPSS 0.78%7.5CVE-2026-45770Oisf suricata out-of-bounds write vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and p…EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2026-22262), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.