CVE-2026-45769— ikev2: unbounded client transform storage can lead to resource exhaustion
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一款网络入侵检测系统、入侵防御系统和网络安全监控引擎。在 7.0.16 和 8.0.5 版本之前，IKEv2 解析器在存储客户端转换参数时，其状态可能会无限增长。重复出现的特制 UDP 流量可能导致 Suricata 消耗大量内存，从而引发拒绝服务（DoS）问题。该问题已在 7.0.16 和 8.0.5 版本中修复。同时提供了一些临时解决方案：如果不需要，可以禁用 IKE 应用层解析；或者使用规则在数据包数量超过阈值后绕过 IKE 流量，例如使用规则 。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ikev2: unbounded client transform storage can lead to resource exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-45769
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45769
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45769 (1)
Proof of Concept for CVE-2026-45769 (1)
Vendor Pages for CVE-2026-45769 (1)
Same Patch Batch · OISF · 2026-09-10 · 15 CVEs total
| CVE-2026-45764 | 9.1 CRITICAL | Suricata http2: protocol-change type confusion can lead to denial of service |
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | 7.5 HIGH | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-45759 | 7.5 HIGH | Suricata http1: quadratic Content-Disposition processing can lead to denial of service |
| CVE-2026-45762 | 7.5 HIGH | Suricata defrag: missing address-family check can lead to remote crash |
| CVE-2026-45765 | 7.5 HIGH | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-45770 | 7.5 HIGH | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-45768 | 7.5 HIGH | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-45766 | 7.5 HIGH | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-45751 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in dotprefix transform |
| CVE-2026-45752 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in decompress transforms |
| CVE-2026-45767 | 4.4 MEDIUM | Suricata datasets: save to absolute filename can be bypassed when combined with load comma |
| CVE-2026-45761 | 3.3 LOW | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rul |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same vendor: OISF
-
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same weakness: CWE-400
-
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh -
CVE-2026-45759
Suricata http1: quadratic Content-Disposition processing can -
CVE-2026-87106
Consul vulnerable to a denial of service in the native RPC l
V. Comments for CVE-2026-45769
No comments yet