CVE-2026-46352

Executive Summary

CVE-2026-46352 is a denial-of-service vulnerability in Suricata, the widely deployed open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. The flaw resides in Suricata's IP defragmentation code, which can deadlock when processing fragmented traffic that contains an encapsulated tunnel protocol whose payload is itself fragmented. Suricata versions 8.0.0 through 8.0.4 are affected; version 8.0.5 contains the fix and no workarounds are available. An unauthenticated remote attacker able to send crafted fragmented packets to a monitored network segment can cause Suricata to deadlock, halting inspection of network traffic and potentially causing a complete loss of visibility or inline prevention capability (CVSS 7.5, Availability High).

Technical Analysis

Suricata's IP defragmentation subsystem is responsible for reassembling fragmented IPv4 (and IPv6) datagrams before further protocol parsing and signature matching occur. Defragmentation is inherently stateful: fragments are held in a queue/tracker keyed by datagram identifiers, and the engine must retain, order, and eventually release these fragment sets. When traffic carries an encapsulated tunnel protocol (for example, an inner IP-in-IP, GRE, or similar tunneling encapsulation) whose encapsulated payload is itself fragmented, the defragmentation logic must handle a nested/re-entrant defragmentation scenario.

Per the NVD description, a deadlock condition arises in this nested-fragmentation path. A deadlock (CWE-833, "Deadlock") is a concurrency defect in which two or more threads of execution or lock holders each wait on a resource the other holds, so neither can proceed. In Suricata's multi-threaded, runmode-based packet pipeline (workers/autofp), a lock held on a fragment-tracking structure or a per-flow state that must be re-acquired during nested decapsulation can produce a circular wait. The precise location — which lock, which structure, and the exact packet pattern that induces the circular wait — cannot be determined from the available description. What is derivable is the vulnerability class: nested fragmentation inside a tunnel payload violates an assumption in the defragmentation concurrency model, producing a permanent block rather than a transient stall.

The key technical properties of this CVE are:

• Attack surface: Raw network traffic on any interface Suricata inspects. No authentication, no application-layer interaction, no user action (CVSS AV:N, AC:L, PR:N, UI:N).
• Trigger precondition: Fragmented traffic that carries an encapsulated tunnel protocol, with the tunnel's payload itself fragmented. This is a specific packet-construction requirement (not simple high-volume traffic).
• Failure mode: Deadlock. Because the decapsulation/defragmentation worker becomes permanently blocked, all inspection reliant on that code path halts. In IPS/inline deployments this can translate to dropped inspection with either pass-through or drop behavior depending on deployment configuration.
• No confidentiality or integrity impact: The CVSS vector reports C:N/I:N — the impact is purely availability (A:H).

There is insufficient technical detail in the provided description to name specific functions, structures, or the lock(s) involved. Analysts must treat the lock topology as undetermined and rely on version detection and packet-pattern detection rather than code-level signatures.

Exploitation Scenarios

This section describes the attack chain at the vulnerability-class level. No public proof-of-concept exists and the chain is inferred from the CWEd class (deadlock in IP defragmentation during nested tunneling) and the CVSS vector.

1. Reconnaissance / target identification. The attacker determines whether a target network is monitored by a Suricata 8.0.0–8.0.4 sensor. Because Suricata is passive by default, this is typically inferred rather than directly observed: an attacker who can place themselves on or send traffic into an inspected segment (e.g., a DMZ, a monitored enclave, or a mirrored span port's source segment) can test for the sensor's presence indirectly via IPS mode signals (dropped packets). Targeted, accurate victim identification is less important than reachability of the monitored segment, since the attack requires only the ability to send crafted packets that the sensor will inspect.

2. Trigger of the flaw class. The attacker crafts fragmented IP traffic that encapsulates a tunnel protocol, where the tunneled payload is itself fragmented. Based strictly on the description, the trigger is the combination of (a) outer fragmentation, (b) a tunnel/encapsulation protocol header, and (c) fragmentation of the inner (encapsulated) payload. This nests a defragmentation operation within a defragmentation operation and, per the advisory, causes the defragmentation code to deadlock. The exact tunnel protocol(s) and fragment ordering that induce the deadlock are not specified in the available data; an attacker would need to enumerate the encapsulation types Suricata supports and vary fragment sizes/offsets, ordering, and overlapping fragments to reproduce the lock.

3. Payload / execution method. At the class level, this is a network-layer resource-exhaustion/concurrency attack rather than a code-execution exploit. There is no memory corruption, no code injection, and no credential or session material involved. The "payload" is the malformed/nested fragmentation pattern itself. Delivery is via raw sockets or crafted packet generators; no host access is required.

4. Post-exploitation impact. Successful triggering causes Suricata's defragmentation worker to deadlock. Depending on deployment mode, consequences include: loss of IDS alerting on affected traffic paths, loss of IPS blocking for inline deployments, and potential process/worker stalls requiring restart of the sensor. The attacker can use this as a prelude to other activity — suppressing detection while conducting follow-on attacks, exfiltration, or lateral movement through the now-unmonitored segment. Repeated triggering can keep the sensor degraded, sustaining a blind spot. Note that deadlock-based DoS does not directly disclose data or modify traffic; the strategic value is detection evasion via availability degradation.

Assumptions and caveats: the exact encapsulation protocol, fragment parameters, and lock sequence are unspecified. Defenders should not assume a single "magic packet" exists until a public analysis or vendor technical note is available.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

• Attack Vector (Network, AV:N): Exploitable by any actor who can deliver packets to an inspected interface. No local access or adjacent-position credentials required.
• Attack Complexity (Low, AC:L): Once the trigger packet pattern is known, no special conditions or race-window timing are required beyond sending crafted fragments. The Low rating implies a reproducible, stable trigger.
• Privileges Required (None, PR:N) / User Interaction (None, UI:N): Fully unauthenticated, no victim action.
• Scope (Unchanged, S:U): The vulnerability does not, per the vector, cross a security authority boundary beyond the Suricata process/sensor.
• Confidentiality/Integrity (C:N/I:N): No direct data disclosure or modification. Indirect impact (detection evasion) is a consequence, not a scored confidentiality/integrity loss.
• Availability (High, A:H): The defragmentation code deadlocks, disabling a core engine function.

Business impact and blast radius: Suricata is deployed broadly across enterprise SOCs, government networks, and critical infrastructure as both sensor and inline IPS. A deadlocked sensor creates a monitoring blind spot and, in inline deployments, can disrupt availability of the protection function — potentially allowing malicious traffic to pass uninspected. Stakeholders most affected are SOC/NOC teams relying on Suricata for detection and inline prevention, and any compliance regime that mandates continuous network monitoring (e.g., PCI DSS, NIST CSF). Because the attack targets the security tool itself, it is a force-multiplier for follow-on intrusions. EPSS is not yet scored by FIRST.org; CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

This rule detects Suricata process instability/restart events that may correlate with deadlock-induced stalls. Adjust channel and process names to your platform.

title: Suricata Process Stall or Restart Indicating Defragmentation Deadlock (CVE-2026-46352)
id: 9f2c1a70-3b8e-4d5f-9c11-0a7e6b2d4c51
status: experimental
description: Detects Suricata process termination/restart or watchdog-driven restarts consistent with a defragmentation deadlock from crafted nested-fragmented tunnel traffic.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-46352
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
  - attack.impact
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - 'suricata'
  selection:
    - 'killed'
    - 'deadlock'
    - 'watchdog'
    - 'Starting Suricata'
    - 'Suricata-Main'
    - 'defrag'
  condition: keywords and selection
falsepositives:
  - Planned service restarts, config reloads, legitimate upgrades
  - Kernel OOM killer terminating Suricata for unrelated memory pressure
level: medium

YARA Rule

The defect is a runtime concurrency bug rather than a file artifact, so file-based YARA detection is limited. The rule below targets artifacts an analyst may collect: core dumps, log excerpts, or captured crafted packets containing encapsulation identifiers associated with tunneled traffic. It is a heuristic aid, not a signature for the specific trigger.

rule CVE_2026_46352_Suricata_Defrag_Deadlock_Artifacts
{
    meta:
        description = "Heuristic detection of Suricata defragmentation-deadlock related artifacts (logs, cores, packet captures). Not a signature for the exact trigger."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-46352"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "suricata" nocase
        $s2 = "defrag" nocase
        $s3 = "deadlock" nocase
        $s4 = "Suricata-Main" ascii
        $s5 = "IPFW" ascii
        $s6 = "decode-ip" ascii
        $s7 = "8.0.5" ascii

    condition:
        (uint32(0) == 0x0a0d0d0a or uint32(0) == 0x464c457f or filesize > 1024) and
        (
            (2 of ($s1, $s2, $s3, $s4))
            or
            (2 of ($s5, $s6))
        ) and not $s7
}

Suricata IDS Rule

This rule alerts on encapsulated tunnel protocols carrying further IP-in-IP fragments — the class of traffic that exercises the vulnerable nested-fragmentation path. Tune the inner encapsulation SIDs to the tunnel protocols deployed in your environment.

alert ip any any -> any any (msg:"CVE-2026-46352 Possible Suricata nested-fragmentation deadlock trigger (tunneled fragmented payload)"; \
  fragbits:M; \
  ip_proto:4; \
  byte_test:1,&,0x40,0,relative; \
  flow:stateless; \
  threshold:type limit, track by_src, count 5, seconds 60; \
  classtype:attempted-dos; \
  sid:90046352; rev:1; \
  metadata:cve CVE-2026-46352, affected_product Suricata, deployment Perimeter;)

Note: ip_proto:4 matches IP-in-IP encapsulation. If GRE (ip_proto 47) or other encapsulation is used in your environment, create companion rules with the corresponding protocol number. Tune byte_test/offset logic to your deployment after validating against the actual trigger, which is not publicly documented.

Elastic Detection

EQL hunting rule for correlated Suricata process/restart and kernel/system events after crafted traffic.

sequence by host.id with maxspan=5m
  [ process where event.type in ("start","change") and process.name : "suricata" ] with runs=2
  [ file where event.action in ("deletion","change") and file.path : "*suricata*" and
    (file.extension : ("core","dmp") or file.path : "*core*") ]

Alternatively, for log-based stall detection:

any where
  (process.name == "suricata" or event.provider == "suricata") and
  (message : "*deadlock*" or message : "*defrag*" or message : "*watchdog*")

Splunk SPL Query

Correlates Suricata restart/watchdog messages with prior alert-drop anomalies on the same sensor.

index=network_logs (source="*suricata*" OR sourcetype="suricata")
(message="*defrag*" OR message="*deadlock*" OR message="*watchdog*" OR message="*Suricata-Main*" OR message="*Starting Suricata*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - last_seen
| table host, message, count, first_seen, last_seen

Optional IDS-side companion search for tunneled fragmented traffic in eve.json:

index=suricata sourcetype=suricata:json event_type=alert alert.signature_id=90046352
| stats count by src_ip, dest_ip, alert.signature
| where count >= 3

Wazuh OSSEC Rule

Detects Suricata deadlock/restart log entries and suspicious fragmented tunnel alerts.

<group name="suricata,cve_2026_46352,">
  <rule id="100352" level="10">
    <decoded_as>suricata</decoded_as>
    <match>defrag|deadlock|watchdog</match>
    <description>CVE-2026-46352: Suricata defragmentation deadlock or watchdog event detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>

  <rule id="100353" level="8">
    <if_sid>100352</if_sid>
    <match>Starting Suricata|Suricata-Main</match>
    <description>CVE-2026-46352: Suricata process restart following defrag event - possible exploitation</description>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the NVD description, however, the vendor states that version 8.0.5 contains the fix, and no workarounds are available. Treat this as a vendor-claimed fix pending independent validation and internal change-control confirmation.

1) Immediate mitigations (no official workaround exists):

• Prioritize upgrade to Suricata 8.0.5 or later as the primary remediation. Because the advisory states no workarounds are available, version upgrade is the only vendor-sanctioned fix.
• If upgrade cannot be performed immediately, reduce exposure: limit which interfaces/segments feed the sensor where operationally feasible; enable automatic process supervision (systemd Restart=always with WatchdogSec, or equivalent) so a deadlocked worker triggers a supervised restart, restoring inspection (this reduces downtime but does NOT prevent the deadlock).
• Harden the monitoring path: restrict who can inject arbitrary raw packets into inspected segments; segment and firewall off management/inspection VLANs; where inline, define fail-open vs. fail-closed behavior to match business risk tolerance.
• Monitor sensor health aggressively (worker heartbeat, eve.json alert rate, drop counters) so a stall is detected quickly and operators can restart the process.

2) Patch / upgrade steps:

• Inventory all Suricata deployments and record exact versions; identify 8.0.0 through 8.0.4 instances.
• Stage 8.0.5+ in a lab, validate rule compatibility and performance, then roll out in maintenance windows across sensors, then inline IPS nodes.
• Verify post-upgrade version and confirm defragmentation workers are stable under test fragmented/tunneled traffic.
• Since patch confidence is 0/4 from tracked sources, corroborate the vendor release notes for 8.0.5 before declaring remediation complete; where possible obtain vendor confirmation the CVE is fixed in 8.0.5.

3) Long-term hardening:

• Adopt a rapid-patch cadence for perimeter security tooling; treat IDS/IPS as high-value attack surface, not passive infrastructure.
• Track vendor security advisories and CVE feeds for Suricata continuously; integrate software bill of materials (SBOM) and version telemetry.
• Deploy defense-in-depth: do not rely on a single sensor; run independent detection (host-based, flow-based) so a single deadlocked node does not create complete blindness.
• Add watchdog/supervisor automation and health SLOs with alerting for security sensor stalls.
• Test resilience with fuzzing/robustness traffic (fragmented and tunneled flows) in pre-production to surface concurrency defects proactively.

References

1. NVD — CVE-2026-46352: https://nvd.nist.gov/vuln/detail/CVE-2026-46352
2. Suricata project — official site and documentation: https://suricata.io/ (consult release notes for 8.0.5)
3. Suricata GitHub repository / release artifacts (verify 8.0.5 fix): https://github.com/OISF/suricata
4. CWE-833 — Deadlock: https://cwe.mitre.org/data/definitions/833.html
5. FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No public proof-of-concept, no Nuclei template, no exploit code, and no CISA KEV listing are associated with CVE-2026-46352 based on the provided data. No known threat actor campaigns are identified. The absence of public exploitation does not preclude targeted abuse; because the flaw degrades a security control, it is attractive for detection-evasion in targeted operations and should be remediated proactively rather than reactively.