CVE-2026-45762— Suricata defrag: missing address-family check can lead to remote crash
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一款集网络入侵检测系统（IDS）、入侵预防系统（IPS）和网络安全评分引擎于一体的安全软件。在 7.0.16 和 8.0.5 之前的版本中，Suricata 的 IP 分片重组跟踪器（defragmentation tracker）在查找过程中未验证现有跟踪器是否与当前处理的报文使用相同的 IP 地址族（IPv4 或 IPv6）。在处理经过构造的 IPv4/IPv6 分片流量时，IPv6 分片可能被错误地关联到 IPv4 的分片重组跟踪器上。当 Suricata 执行相应的分片重组时，这种错误关
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45762
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Suricata defrag: missing address-family check can lead to remote crash
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AF_PACKET, enabling AF_PACKET's `defrag` option may prevent Suricata from seeing such fragmented packets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-45762
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45762
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45762 (1)
Vendor Pages for CVE-2026-45762 (1)
Other References for CVE-2026-45762 (1)
Same Patch Batch · OISF · 2026-09-10 · 15 CVEs total
| CVE-2026-45764 | 9.1 CRITICAL | Suricata http2: protocol-change type confusion can lead to denial of service |
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | 7.5 HIGH | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-45759 | 7.5 HIGH | Suricata http1: quadratic Content-Disposition processing can lead to denial of service |
| CVE-2026-45769 | 7.5 HIGH | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45765 | 7.5 HIGH | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-45770 | 7.5 HIGH | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-45768 | 7.5 HIGH | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-45766 | 7.5 HIGH | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-45751 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in dotprefix transform |
| CVE-2026-45752 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in decompress transforms |
| CVE-2026-45767 | 4.4 MEDIUM | Suricata datasets: save to absolute filename can be bypassed when combined with load comma |
| CVE-2026-45761 | 3.3 LOW | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rul |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso
Same vendor: OISF
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso
Same weakness: CWE-843
V. Comments for CVE-2026-45762
No comments yet