CVE-2026-45752— Suricata detect/transform: use-after-free in decompress transforms
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一款网络入侵检测系统（IDS）、入侵防御系统（IPS）及网络安全监控引擎。 在 8.0.0 版本及之后、但低于 8.0.5 的版本中，当某些检测变换（detection transforms）被链式组合使用时， （解压缩）变换管道可能在检查缓冲区（inspection buffer）被重新分配并释放后仍尝试从中读取数据，从而导致内存错误。该问题在网络流量处理过程中被触发，但需要存在恶意规则；若缺少此类规则，Suricata 无论收到何种流量都会崩溃。 8.0.5 版本已包含对该问题的修复。 临时
Possible ATT&CK Techniques 1 AI
T1073
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45752
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Suricata detect/transform: use-after-free in decompress transforms
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-45752
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45752
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45752 (1)
Proof of Concept for CVE-2026-45752 (1)
Vendor Pages for CVE-2026-45752 (1)
Same Patch Batch · OISF · 2026-09-10 · 15 CVEs total
| CVE-2026-45764 | 9.1 CRITICAL | Suricata http2: protocol-change type confusion can lead to denial of service |
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | 7.5 HIGH | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-45759 | 7.5 HIGH | Suricata http1: quadratic Content-Disposition processing can lead to denial of service |
| CVE-2026-45762 | 7.5 HIGH | Suricata defrag: missing address-family check can lead to remote crash |
| CVE-2026-45769 | 7.5 HIGH | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45765 | 7.5 HIGH | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-45770 | 7.5 HIGH | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-45768 | 7.5 HIGH | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-45766 | 7.5 HIGH | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-45751 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in dotprefix transform |
| CVE-2026-45767 | 4.4 MEDIUM | Suricata datasets: save to absolute filename can be bypassed when combined with load comma |
| CVE-2026-45761 | 3.3 LOW | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rul |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso
Same vendor: OISF
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso
Same weakness: CWE-416
-
CVE-2026-45751
Suricata detect/transform: use-after-free in dotprefix trans -
CVE-2026-88032
Application denial of service via cancellation race in react -
CVE-2026-87933
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use aft -
CVE-2026-87877
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters -
CVE-2026-87825
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compress
V. Comments for CVE-2026-45752
No comments yet