CVE-2026-45752

Executive Summary

CVE-2026-45752 is a use-after-free vulnerability in Suricata versions 8.0.0 through 8.0.4. The flaw resides in the decompress transform pipeline and is triggered when certain detection transforms are chained in a processing rule with specific parameters. While the issue is reached during network traffic processing, exploitation requires a malicious rule configured by an operator, making the practical attack surface limited to controlled Suricata deployments. Successful triggering causes Suricata to crash, resulting in a denial-of-service condition for the network monitoring capability.

Technical Analysis

Suricata is a high-performance network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. Detection transforms are rule-based operations that mutate or normalize data extracted from traffic to enable richer signature matching. The decompress transform pipeline is responsible for handling compressed payload data, primarily through transforms such as gunzip and zlib_deflate.

The vulnerability is classified as CWE-416: Use After Free. Starting in Suricata 8.0.0 and prior to 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. This represents a memory-safety defect where a pointer to an inspection buffer becomes stale after the buffer is deallocated and reallocated, yet the pipeline continues to dereference it.

The NVD description specifies that the issue requires a malicious rule. The specific dangerous rule pattern is explicitly documented: chaining gunzip or zlib_deflate with a max-size bigger than 4096 after another transform. Under this configuration, the decompression logic can trigger pipeline state that results in the stale-buffer read. Suricata will crash regardless of the traffic being processed, indicating the defect is in rule-pipeline initialization or state management rather than being dependent on specific packet contents.

Affected code paths are reachable during network traffic processing, but the trigger condition is the rule set itself. This distinction matters for threat modeling. The vulnerability does not appear to be remotely triggerable by an unauthenticated network attacker without a pre-existing malicious or misconfigured rule. CVSS 3.1 reflects this: AV:N (network) with AC:H (high attack complexity) and PR:N (no privileges required), but the high complexity corresponds to the requirement for a specifically crafted rule rather than trivial traffic alone.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-45752. The following analysis is derived strictly from the NVD description and the vulnerability class (use-after-free in a transform pipeline).

1. Reconnaissance / target identification: An attacker or insider with the ability to influence, submit, or modify Suricata rule sets identifies a target running Suricata 8.0.0 through 8.0.4. This could be an internal actor with rule-authoring access, a supply-chain vector involving distributed rule sets, or a misconfiguration where untrusted rules are loaded. External reconnaissance of a network sensor alone is insufficient because the trigger is rule-side, not traffic-side.

2. Triggering the flaw class: The attacker constructs or injects a detection rule that chains gunzip or zlib_deflate with max-size bigger than 4096 after another transform. When Suricata loads and evaluates this rule, the decompress transform pipeline is entered with the problematic chaining configuration. The pipeline reallocates and frees the inspection buffer, then subsequently reads from the stale pointer.

3. Payload / execution method at the vulnerability-class level: This is a use-after-free (CWE-416) in the decompress transform pipeline. The immediate effect of the stale-buffer read is a crash of the Suricata process. Per the NVD description, Suricata will crash whatever the traffic is once the malicious rule is active, meaning no special packet payload is required to complete the denial-of-service.

4. Post-exploitation impact: The primary confirmed impact is availability loss — Suricata terminates, interrupting IDS/IPS/NSM coverage. There is no documented evidence of code execution, memory corruption leading to control-flow hijack, information disclosure, or privilege escalation in the advisory. Integrity and confidentiality impact are assessed as NONE per the CVSS vector.

Impact Assessment

The CVSS 3.1 base score is 5.9 (Medium), with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The subscores indicate:

• Attack Vector (Network): The vulnerable component processes network traffic and can be reached over a network path, though the triggering precondition is rule-based.
• Attack Complexity (High): Exploitation is not trivial; a specific rule chaining pattern with max-size bigger than 4096 after another transform is required.
• Privileges Required (None) and User Interaction (None): No specific privileges or user action are modeled by the vector.
• Scope (Unchanged): The impact is confined to the Suricata process.
• Confidentiality (None) and Integrity (None): No documented data exposure or modification.
• Availability (High): Suricata crashes, producing a denial-of-service for the network security monitoring function.

Business impact centers on the loss of network visibility and prevention. Organizations relying on Suricata for perimeter or internal IDS/IPS may experience a gap in detection and enforcement while the sensor is down. Because the crash is deterministic once the offending rule is present, repeated restarts will re-trigger the fault until the rule is removed or the software is upgraded. There is no CISA KEV listing and no evidence of active exploitation; the blast radius is limited to deployments where the vulnerable version is paired with a rule set matching the dangerous pattern.

Detection Guidance

Sigma Rule

title: Suricata Use-After-Free via Decompress Transform Rule Chaining (CVE-2026-45752)
id: 9f2c1a44-7b3e-4d6f-9a21-0c9e5b7d3f10
status: experimental
description: Detects Suricata service crashes potentially caused by chained decompress transforms with max-size greater than 4096 (CVE-2026-45752).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45752
author: valtersit.com
date: 2026/01/01
tags:
    - attack.t1190
    - cve.2026.45752
logsource:
    product: linux
    service: syslog
detection:
    selection_process:
        process_name|contains:
            - 'suricata'
    selection_crash:
        message|contains|all:
            - 'suricata'
        message|contains:
            - 'segfault'
            - 'core dumped'
            - 'signal 11'
            - 'use-after-free'
    condition: selection_process and selection_crash
falsepositives:
    - Legitimate sensor restarts
    - Unrelated memory faults
level: high

YARA Rule

rule CVE_2026_45752_Suricata_UAF_Rule_Chaining
{
    meta:
        description = "Detects Suricata rules chaining decompress transforms with max-size greater than 4096 (CVE-2026-45752)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45752"
        cve = "CVE-2026-45752"

    strings:
        $gunzip = "gunzip" ascii nocase
        $zlib = "zlib_deflate" ascii nocase
        $maxsize = "max-size" ascii nocase
        $chain = "decompress" ascii nocase

    condition:
        (uint16(0) == 0x2121 or true) and
        ($chain or $gunzip or $zlib) and
        $maxsize
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-45752 Suricata Decompress Transform Chain Crash Attempt"; flow:to_server,established; content:"max-size"; nocase; content:"gunzip"; nocase; distance:0; content:"decompress"; nocase; distance:0; classtype:attempted-dos; sid:202645752; rev:1;)

Note: Because the trigger is a rule configuration rather than network traffic, this Suricata rule is provided as a best-effort content heuristic for environments where rule updates traverse the network. The primary detection surface for CVE-2026-45752 is log and configuration monitoring.

Elastic Detection

process where process.name : "suricata" and
  (message : "*use-after-free*" or message : "*segfault*" or message : "*core dumped*")

Splunk SPL Query

index=main (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=suricata)
| search "suricata" ("segfault" OR "core dumped" OR "use-after-free" OR "signal 11")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, message
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="suricata,cve-2026-45752,">
  <rule id="100752" level="12">
    <decoded_as>syslog</decoded_as>
    <program_name>^suricata</program_name>
    <regex>segfault|core dumped|signal 11|use-after-free</regex>
    <description>Suricata crash detected - possible CVE-2026-45752 use-after-free in decompress transform pipeline</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is present in the tracked sources beyond the NVD narrative. The NVD description itself states that version 8.0.5 contains a fix, and that statement is the only patch reference available.

1. Immediate mitigations:

   • Remove or modify any rule that chains gunzip or zlib_deflate with max-size bigger than 4096 after another transform. This is the documented workaround.
   • Audit the active rule set for the dangerous transform chaining pattern and quarantine rule updates from untrusted sources.
   • Restrict who can author or deploy Suricata rules to trusted administrators.
   • Enable process supervision so Suricata restarts are logged and alerted; repeated crashes are the main observable signal.

2. Patch / upgrade steps:

   • Upgrade to Suricata 8.0.5 or later as identified in the NVD description. Verify the vendor's release notes and package integrity before deployment.
   • Because no vendor fix has been confirmed by tracked patch sources, validate the upgrade against the CVE independently and confirm the vulnerable transform path is corrected in the shipped build.

3. Long-term hardening:

   • Treat rule sets as security-critical configuration; apply code-review and change-control to any transform chaining, especially decompression transforms with size parameters.
   • Enforce least privilege on rule distribution pipelines to reduce the likelihood of a malicious rule being introduced.
   • Monitor Suricata process health and crash logs continuously (see Detection Guidance), and retain memory-safety fuzzing of transform pipelines as part of the vendor-side assurance process.

References

• NVD — CVE-2026-45752: https://nvd.nist.gov/vuln/detail/CVE-2026-45752
• MITRE CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• Suricata Project: https://suricata.io/
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-45752 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template were identified for CVE-2026-45752 in the provided data. There is no current evidence of exploitation in the wild.