CVE-2026-45770— Suricata lua: excessive flow variable registration can bypass sandbox
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一款网络入侵检测系统（IDS）、入侵防御系统（IPS）以及网络安全监控引擎。 从版本 8.0.0 开始到 8.0.5 之前，如果某条 Lua 规则注册了过多的流变量（flow variables），可能会导致 Lua 检测状态被破坏，并可能绕过 Suricata 受限的 Lua 沙箱环境。该漏洞的发生前提是需要加载了存在问题的 Lua 脚本或规则。此外，注册过多的流变量还可能导致 Suricata 崩溃。 版本 8.0.5 已包含修复。 临时解决方案：除非需要使用 Lua 规则，否则建议禁用 配
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45770
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Suricata lua: excessive flow variable registration can bypass sandbox
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-45770
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45770
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45770 (1)
Mailing List Discussions for CVE-2026-45770 (1)
-
🔗 Open Information Security Foundation x_refsource_MISC
Vendor Pages for CVE-2026-45770 (1)
Same Patch Batch · OISF · 2026-09-10 · 15 CVEs total
| CVE-2026-45764 | 9.1 CRITICAL | Suricata http2: protocol-change type confusion can lead to denial of service |
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | 7.5 HIGH | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-45759 | 7.5 HIGH | Suricata http1: quadratic Content-Disposition processing can lead to denial of service |
| CVE-2026-45762 | 7.5 HIGH | Suricata defrag: missing address-family check can lead to remote crash |
| CVE-2026-45769 | 7.5 HIGH | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45765 | 7.5 HIGH | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-45768 | 7.5 HIGH | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-45766 | 7.5 HIGH | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-45751 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in dotprefix transform |
| CVE-2026-45752 | 5.9 MEDIUM | Suricata detect/transform: use-after-free in decompress transforms |
| CVE-2026-45767 | 4.4 MEDIUM | Suricata datasets: save to absolute filename can be bypassed when combined with load comma |
| CVE-2026-45761 | 3.3 LOW | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rul |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same vendor: OISF
-
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45767
Suricata datasets: save to absolute filename can be bypassed -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh
Same weakness: CWE-693
-
CVE-2026-76059
Langflow is vulnerable to arbitrary code execution due to mu -
CVE-2026-0306
Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Wi -
CVE-2026-79638
Dell SCG 5.0低于5.36版本跨站脚本漏洞 -
CVE-2026-87808
SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextS -
CVE-2026-78552
Validation Bypass in Okta Access Gateway Custom Directives
V. Comments for CVE-2026-45770
No comments yet