CVE-2026-45767— Suricata datasets: save to absolute filename can be bypassed when combined with load command
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一个网络入侵检测系统（NIDS）、入侵防御系统（NIPS）以及网络安全监控引擎。在版本 7.0.16 和 8.0.5 之前，恶意规则可能在加载或重新加载规则时覆盖文件系统中的任意文件。版本 7.0.16 和 8.0.5 已修复该问题。目前有一些临时解决方案可用：预处理 和 规则，禁止在 操作中使用绝对路径文件名；利用 Suricata 的权限降低机制限制可写文件范围；和/或在 suricata.yaml 中配置 landlock 以增强文件访问控制。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45767
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Suricata datasets: save to absolute filename can be bypassed when combined with load command
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-45767
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45767
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45767 (1)
Vendor Pages for CVE-2026-45767 (1)
Other References for CVE-2026-45767 (1)
-
🔗 Open Information Security Foundation x_refsource_MISC
Same Patch Batch · OISF · 2026-09-10 · 15 CVEs total
| CVE-2026-45764 | 9.1 CRITICAL | Suricata http2: protocol-change type confusion can lead to denial of service |
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | 7.5 HIGH | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-45759 | 7.5 HIGH | Suricata http1: quadratic Content-Disposition processing can lead to denial of service |
| CVE-2026-45762 | 7.5 HIGH | Suricata defrag: missing address-family check can lead to remote crash |
| CVE-2026-45769 | 7.5 HIGH | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45765 | 7.5 HIGH | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-45770 | 7.5 HIGH | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-45768 | 7.5 HIGH | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-45766 | 7.5 HIGH | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-45751 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in dotprefix transform |
| CVE-2026-45752 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in decompress transforms |
| CVE-2026-45761 | 3.3 LOW | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rul |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same vendor: OISF
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same weakness: CWE-22
-
CVE-2026-49836
psd-tools: arbitrary file write via smart-object filename -
CVE-2026-80424
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-81540
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-81551
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-81554
DataStage on Cloud Pak for Data has several vulnerabilities
V. Comments for CVE-2026-45767
No comments yet