CVE-2026-45763

Executive Summary

CVE-2026-45763 is a resource-exhaustion weakness (CWE-770: Allocation of Resources Without Limits or Throttling) in Suricata's Lua rule execution sandbox, affecting versions 8.0.0 through 8.0.4. When Lua rule execution is enabled, the configured security.lua.max-bytes sandbox memory limit was not consistently enforced for new allocations, allowing certain allocation patterns to exceed the intended cap. The practical impact is denial of service: unstable or exhausted memory conditions in the IDS/IPS/NSM sensor process, with a CVSS 3.1 base score of 5.9 (Availability: High; Confidentiality/Integrity: None; Attack Complexity: High).

Technical Analysis

Suricata's Lua rule support allows operators to extend detection logic with Lua scripts executed within a sandbox. The sandbox exposes configuration knobs under the security.lua.* namespace, of which security.lua.max-bytes defines the maximum memory budget a Lua script may allocate. Per the NVD description, the enforcement of this limit was inconsistent: specifically, "the Lua sandbox memory limit was not consistently enforced for new allocations." As a result, "certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit," rendering "the configured sandbox limit unreliable."

This is a classic limit-enforcement gap (CWE-770) rather than a classic heap-overflow or type-confusion bug. The failure mode is best understood as an accounting/bypass condition: the sandbox mechanism that meters or rejects allocations did not reliably cover every allocation pathway available to a loaded script. Because only paths not covered by the metering logic are implicated, the precise set of triggering allocation patterns is implementation-dependent and is not enumerated in the available description. No specific Lua API, C function, or allocation primitive is named in the CNA/NVD text, and none should be assumed.

Two preconditions are required for exposure:

1. Lua rule execution must be enabled (i.e., security.lua.allow-rules is in its permitting state).
2. An affected Lua script/rule must be loaded into the engine.

Because both conditions concern the sensor's own rule/script configuration rather than remote input, the "attack surface" is the Suricata process itself and the rule content it loads. The CVSS vector confirms this posture: Network attack vector with High attack complexity, no privileges required, and Availability-only impact. The High complexity is consistent with the requirement that a specifically crafted Lua script/rule and specific allocation patterns be present and executed — it is not a trivially reachable condition from arbitrary network traffic.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-45763. The following attack chain is described at the vulnerability-class level strictly from the NVD description; no specific Lua functions, identifiers, or code patterns are asserted because they are not present in the source data.

1. Reconnaissance / target identification. An adversary must first identify a Suricata deployment running an affected version (8.0.0–8.0.4) that has Lua rule execution enabled. This knowledge is typically obtained through configuration exposure, insider access, or supply-chain positioning — not through unauthenticated network probing, since the setting is not externally advertised.

2. Triggering the flaw class. The precondition is that a Lua script/rule with allocation patterns capable of evading the sandbox meter is loaded. Per the description, the sandbox limit is "not consistently enforced for new allocations," so the script exercises allocation pathways that do not decrement or check the security.lua.max-bytes accounting. This is a limit-bypass rather than a memory-corruption primitive.

3. Execution method (class-level). Once such a script is loaded and executed by the engine, its allocations proceed despite — and beyond — the configured cap. No remote payload delivery, authentication bypass, or memory-safety manipulation is described; the "exploit" is effectively an over-allocating Lua rule that the sandbox fails to constrain.

4. Post-exploitation impact. The direct consequence is memory exhaustion / resource starvation inside the Suricata process, which can degrade or halt detection and prevention — a denial-of-service condition. The CVSS vector (C:N/I:N/A:H) indicates no confidentiality or integrity impact is expected. Depending on deployment, loss of the sensor may create a detection blind spot for any traffic it was monitoring.

Impact Assessment

• CVSS 3.1: 5.9 (Medium) — AV:N / AC:H / PR:N / UI:N / S:U / C:N / I:N / A:H.
• Availability (High): the primary impact. Unchecked allocation can exhaust memory in the sensor process, causing crash, unresponsiveness, or restart loops. Because Suricata is inline IPS in many deployments, availability loss can also interrupt traffic inspection or forwarding.
• Confidentiality / Integrity (None): no data disclosure or modification is described.
• Attack Complexity (High): requires Lua rules be enabled and a specific affected script/rule loaded, and depends on allocation-pattern specifics.
• Scope (Unchanged): impact is confined to the Suricata component.
• Blast radius: limited to hosts running affected Suricata versions with Lua rules enabled. Environments that do not enable Lua rule execution (the default restrictive posture, per the advisory's workaround guidance) are not exposed. No CISA KEV listing and no EPSS score are available as of this report; there is no evidence of in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Suricata Lua Sandbox Memory Limit Bypass Attempt (CVE-2026-45763)
id: 6f1e9c2b-3a4d-4c7e-9b2f-45763cve2026
status: experimental
description: Detects process/audit events consistent with Suricata running Lua rules where sandbox memory enforcement may be bypassed (CVE-2026-45763).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45763
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_suricata:
    exe|endswith: '/suricata'
  selection_lua:
    - 'security.lua.allow-rules'
    - 'security.lua.max-bytes'
  condition: selection_suricata and selection_lua
fields:
  - CommandLine
  - exe
  - User
falsepositives:
  - Legitimate Suricata administrators adjusting Lua sandbox configuration
level: medium

YARA Rule

rule CVE_2026_45763_Suricata_Lua_Sandbox
{
    meta:
        author = "valtersit.com"
        description = "Detects Suricata configs enabling Lua rules where sandbox memory limit enforcement may be bypassed (CVE-2026-45763)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45763"
        date = "2026-01-01"
    strings:
        $cfg1 = "security.lua.allow-rules" ascii wide
        $cfg2 = "security.lua.max-bytes" ascii wide
        $ver  = "suricata" nocase ascii wide
    condition:
        $ver and any of ($cfg*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-45763 Suricata Lua sandbox memory limit bypass - rule/config load indicator (correlation)"; flow:to_server,established; content:"security.lua.allow-rules"; nocase; sid:4576301; rev:1; metadata:reference nvd.nist.gov,mitre_technique T1499; classtype:attempted-dos;)

Note: because exploitation occurs via locally loaded Lua rules rather than a network request, this Suricata rule functions as a configuration/indicator correlation rule. Network-level exploitation signatures are not available from the advisory data.

Elastic Detection

process where process.name == "suricata" and
  process.args : ("*security.lua.allow-rules*", "*security.lua.max-bytes*")

Splunk SPL Query

index=os sourcetype=linux_audit OR sourcetype=sysmon
(process_path="*/suricata" OR process_name="suricata")
process_args IN ("*security.lua.allow-rules*", "*security.lua.max-bytes*")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_args

Wazuh OSSEC Rule

<group name="suricata,cve_2026_45763">
  <rule id="457631" level="7">
    <decoded_as>json</decoded_as>
    <field name="syscheck.path">\.lua$</field>
    <description>CVE-2026-45763: Suricata Lua rule file modified - verify sandbox memory limit enforcement</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>suricata_lua,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-fix reference, OSV package entry, or workaround field was supplied in the tracked data; affected-version lists are empty outside the NVD narrative range.

1. Immediate mitigations.

   • Apply the vendor-advisory workaround: disable security.lua.allow-rules unless Lua rules are strictly required. This removes the precondition for exposure.
   • If Lua rules are required, audit loaded scripts for allocation-heavy behavior and restrict the rule set to trusted, reviewed scripts.
   • Monitor Suricata process memory usage and restart stability; alert on anomalous growth in sensors running Lua rules.

2. Patch / upgrade steps.

   • Upgrade to Suricata 8.0.5, which the NVD description states contains the fix.
   • Validate version post-upgrade and confirm security.lua.max-bytes enforcement with the organization's Lua rules under test/lab conditions before production promotion.

3. Long-term hardening.

   • Adopt a least-functionality policy for engine extensions: do not enable Lua rule execution where it is not operationally necessary.
   • Implement resource limits at the OS/container layer (cgroups memory caps, systemd MemoryMax) to bound the blast radius of sandbox-limit failures.
   • Track Suricata security releases and subscribe to the OISF advisory channel for future sandbox-related fixes.

References

1. NVD — CVE-2026-45763: https://nvd.nist.gov/vuln/detail/CVE-2026-45763
2. Suricata (Open Information Security Foundation) — project and release advisories: https://suricata.io/
3. CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CISA KEV Catalog (CVE-2026-45763 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation status: No public PoC, exploit code, or Nuclei template identified. No EPSS score available. No known threat actor campaign or exploit-in-the-wild evidence. security.lua.max-bytes enforcement is the affected control; no further implementation specifics are available from the provided intelligence.