CVE-2026-57224

Executive Summary

CVE-2026-57224 is a resource-exhaustion vulnerability in Suricata, the widely deployed open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. Affected releases are 8.0.0 through before 8.0.6. The DHCP parser (rust/src/dhcp/dhcp.rs) and the RDP parser (rust/src/rdp/rdp.rs) create stateless transactions without recording packet direction via AppLayerTxData::for_direction(), so a sensor that observes only one direction of a flow cannot mark the unseen direction as inspected or free completed transactions. Because the per-flow transaction list grows without bound and cleanup repeatedly scans it, an attacker who can deliver crafted DHCP or RDP traffic to a sensor vantage point can drive steadily increasing CPU and memory consumption culminating in denial of service. The vulnerability is rated CVSS 3.1 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), i.e. an adjacent-network, low-complexity, unauthenticated availability-only impact.

Technical Analysis

The defect is a state-tracking flaw in Suricata's Rust-based application-layer parsers, not a memory-safety or code-execution flaw. The NVD description states that the DHCP parser in rust/src/dhcp/dhcp.rs "creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction()". The same direction-state defect is present in the RDP parser in rust/src/rdp/rdp.rs.

Two mechanisms combine to produce the impact:

1. Missing directional state. Suricata's application-layer transaction model associates each transaction with a flow direction. The AppLayerTxData::for_direction() API is the mechanism by which a parser records which direction a transaction belongs to, enabling the engine to mark the opposite (unseen) direction as inspected and to release transactions once a flow completes. Because the DHCP and RDP parsers omit this call, transactions are created in a "stateless" manner with no recorded direction.

2. Unbounded growth plus repeated linear cleanup. In a deployment where the sensor observes only one direction of a flow — common for asymmetric routing, one-armed/SPAN capture, or partial tap visibility — the engine cannot mark the unseen direction inspected and therefore cannot free completed transactions. The per-flow transaction list consequently grows without bound. The cleanup routine must repeatedly scan this ever-growing list, so each cleanup pass costs more CPU as the list lengthens, producing a compounding (super-linear in practice) CPU and memory burden.

The attack surface is the parser input path, not an authenticated management plane. Both DHCP and RDP are UDP/TCP application protocols processed by the IDS/IPS datapath. Because the flaw is triggered by ordinary well-formed protocol traffic that the parser treats as new transactions, no credentials, no user interaction, and no exploit payload beyond valid protocol messages are required — consistent with the CVSS vector's PR:N and UI:N. The AV:A (Adjacent) value reflects that the attacker must be positioned to have traffic reach the sensor's capture vantage point (same broadcast domain / adjacent network segment or an inspected path), rather than being a remote interneteer.

It is important not to overstate the flaw: the NVD description does not indicate memory corruption, out-of-bounds access, or code execution. The sole impact is availability (C:N/I:N/A:H).

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available; the attack chain is inferred strictly from the vulnerability class (CWE-400, uncontrolled resource consumption) and the parser behavior described by NVD.

1. Reconnaissance / target identification. The attacker identifies a network containing a Suricata 8.0.0–8.0.5 sensor and determines the sensor's visibility characteristics — specifically whether the sensor sees only one direction of a flow (asymmetric routing, single-direction SPAN/port mirror, or a one-armed capture arrangement). The attacker also identifies a path where DHCP or RDP traffic transits through the monitored segment that the sensor observes. Note: targeting is aided by the fact that Suricata's version banners and management interfaces may be discoverable; no specific banner string is specified in the source data.

2. Triggering the flaw class. The attacker generates DHCP or RDP traffic such that transactions are created in the vulnerable parsers. Because the affected parsers do not record direction, each such transaction is not reconciled against the opposite direction and is not freed when the flow would otherwise be considered complete. The attacker sustains or repeats this traffic so that the per-flow transaction list continues to accumulate. The core trigger is the volume and continuation of protocol transactions on flows the sensor can only observe one way — not a malicious payload.

3. Payload / execution method (vulnerability-class level). No specialized payload is required. The "payload" is valid DHCP or RDP protocol traffic that the parser ingests as new application-layer transactions. The attacker simply needs a traffic generator capable of emitting DHCP or RDP conversations toward the sensor's observed segment; the resource consumption arises from the parser's inability to retire transactions, not from malformed input. No memory-corruption primitive is involved.

4. Post-exploitation impact. As transactions accumulate, cleanup scans lengthen and CPU consumption rises while memory held by the transaction lists grows. On a sensor with finite CPU/memory headroom, the process eventually saturates CPU, exhausts memory, and can be terminated or become unable to process traffic — a denial of service. Critically, this degrades detection and prevention coverage for the entire protected network: an IDS/IPS that is down or starved of resources cannot alert on or block other attacks, creating a window in which the attacker's primary objective (e.g., intrusion elsewhere) proceeds undetected. This is the dominant operational risk even though the direct impact is availability-only.

Impact Assessment

CVSS 3.1 base score 6.5 (Medium), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H:

• Attack Vector: Adjacent (A) — the attacker must be positioned to have DHCP or RDP traffic reach the sensor's capture vantage point.
• Attack Complexity: Low (L) — no special conditions or race windows; the parsers reliably fail to track direction.
• Privileges Required: None (N) and User Interaction: None (N) — no credentials; no operator action needed to trigger parsing.
• Scope: Unchanged (U) — the vulnerable Suricata component remains the affected security authority.
• Confidentiality: None (C:N), Integrity: None (I:N) — no data disclosure or modification.
• Availability: High (A:H) — sustained resource exhaustion culminating in DoS.

Business impact. Suricata is commonly deployed at network perimeters, DMZs, data-center east-west boundaries, and cloud VPC mirrors. An availability failure of the sensor directly degrades an organization's IDS/IPS, NSM, and potentially its compliance-mandated monitoring. Affected systems are Suricata 8.0.0 through 8.0.5 instances — especially those deployed where packet capture is asymmetric or one-directional, which is common with SPAN ports, tap aggregation, and cloud mirror sessions.

Blast radius. The vulnerable process is the sensor itself; there is no lateral propagation to monitored hosts. However, the secondary effect is network-wide loss of visibility and enforcement. Peak EPSS has not been assigned by FIRST.org, there is no CISA KEV listing, and no exploit-in-the-wild evidence is reported here. Exploitation requires adjacency and sustained traffic, which raises the practical barrier but does not eliminate risk for exposed/edge-monitoring deployments.

Detection Guidance

Sigma Rule

title: Potential Suricata DHCP/RDP Transaction Exhaustion (CVE-2026-57224)
id: 7c1f3a9b-2d44-4e8a-9f21-cve20265722
status: experimental
description: Detects anomalous growth/resource exhaustion patterns in Suricata sensor logs consistent with CVE-2026-57224 DHCP/RDP direction-state defect
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57224
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  product: suricata
  service: ids
detection:
  selection_process:
    Image|endswith: '/suricata'
  selection_keywords:
    - 'dhcp'
    - 'rdp'
    - 'transaction'
  selection_behavior:
    - 'flow timeout'
    - 'memory limit'
    - 'alert queue full'
  condition: selection_process and selection_keywords and selection_behavior
falsepositives:
  - Legitimate high-volume DHCP/RDP segments with asymmetric capture
level: medium
tags:
  - attack.t1499
  - cve.2026.57224

YARA Rule

rule CVE_2026_57224_Suricata_DHCP_RDP_DirectionState
{
    meta:
        description = "Detects Suricata 8.0.0-8.0.5 DHCP/RDP parser binaries lacking AppLayerTxData::for_direction handling context for CVE-2026-57224"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57224"
        date = "2026-01-01"
        cve = "CVE-2026-57224"

    strings:
        $s1 = "suricata" ascii wide nocase
        $s2 = "dhcp.rs" ascii wide
        $s3 = "rdp.rs" ascii wide
        $s4 = "AppLayerTxData" ascii wide
        $s5 = "for_direction" ascii wide
        $ver1 = "8.0.0" ascii
        $ver2 = "8.0.5" ascii

    condition:
        uint16(0) == 0x5A4D and
        ($s1 or $s2 or $s3) and
        not $s5 and
        any of ($ver*)
}

Suricata IDS Rule

alert udp any any -> any 67 (msg:"CVE-2026-57224 Suricata DHCP Parser Transaction Exhaustion Attempt"; flow:to_server; dsize:>0; threshold: type both, track by_src, count 200, seconds 60; classtype:attempted-dos; sid:10057224; rev:1;)
alert tcp any any -> any 3389 (msg:"CVE-2026-57224 Suricata RDP Parser Transaction Exhaustion Attempt"; flow:to_server,established; threshold: type both, track by_src, count 200, seconds 60; classtype:attempted-dos; sid:10057225; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where destination.port == 67 and network.transport == "udp"]
  [network where destination.port == 67 and network.transport == "udp"]
  [network where destination.port == 67 and network.transport == "udp"]

(Companion query for RDP, substituting destination.port == 3389 and network.transport == "tcp". In production, tune with process.name == "suricata" correlation and event.category: network.)

Splunk SPL Query

index=ids sourcetype=suricata event_type="flow" OR event_type="alert"
| stats count by src_ip, dest_port
| where (dest_port=67 OR dest_port=3389) AND count > 200
| sort - count
| table src_ip dest_port count

Wazuh OSSEC Rule

<group name="suricata,cve-2026-57224,">
  <rule id="100224" level="10">
    <if_sid>100000</if_sid>
    <decoded_as>json</decoded_as>
    <field name="event_type">^flow$</field>
    <field name="dest_port">^(67|3389)$</field>
    <description>CVE-2026-57224: Possible Suricata DHCP/RDP transaction exhaustion traffic detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED / no patch evidence from tracked sources. No vendor-supplied patch reference, workaround, or affected-version machine-readable data was provided beyond the NVD statement that the issue is fixed in 8.0.6. Treat the following as defensive guidance pending authoritative confirmation.

1. Immediate mitigations (if unable to upgrade):

   • Reduce exposure of the sensor's DHCP and RDP visibility: where operationally feasible, disable DHCP and RDP application-layer parsing for segments that exhibit only one-directional capture (app-layer.protocols.dhcp / app-layer.protocols.rdp style configuration toggles — verify exact key names against your Suricata 8.0.x documentation, as they are not specified in the CVE data).
   • Reduce flow/transaction memory pressure: lower configured transaction and flow timeouts and memory caps so runaway lists are bounded sooner, and monitor for flow and app-layer memory limit alerts.
   • Ensure sensors are not exposed to untrusted or adjacent traffic on DHCP (UDP/67) and RDP (TCP/3389) segments where capture is asymmetric; segment sensor capture interfaces accordingly.
   • Monitor sensor CPU and memory continuously and alert on unbounded growth correlated with DHCP/RDP segments.

2. Patch / upgrade steps:

   • Upgrade Suricata to 8.0.6 or later, which the NVD description states fixes the issue. Validate against your distribution/vendor packaging (source build rust/src/dhcp/dhcp.rs and rust/src/rdp/rdp.rs are the components addressed).
   • Because patch confidence is 0/4, independently verify the 8.0.6 release notes and changelog before treating the release as authoritative.

3. Long-term hardening:

   • Standardize on current, supported Suricata releases and track upstream security advisories; do not run end-of-life sensor versions.
   • Architect capture to provide symmetric, bidirectional visibility wherever possible, since the defect is only impactful where the sensor sees one direction.
   • Implement resource guarding: cgroup/container CPU and memory limits, watchdog restart policies, and separate management/monitoring tees so a saturated sensor does not blind an entire deployment.
   • Add the Sigma/YARA rule above to CI or build pipelines to detect parser builds lacking direction-tracking calls.

References

• NVD — CVE-2026-57224: https://nvd.nist.gov/vuln/detail/CVE-2026-57224
• Suricata project / upstream release notes for version 8.0.6 (verify at the official Suricata release channel; the NVD description names 8.0.6 as the fix)
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS — CVE-2026-57224 (no score yet assigned as of this report): https://api.first.org/data/v1/epss?cve=CVE-2026-57224

Exploit-in-the-wild / threat actor note: No CISA KEV listing, no public PoC, no Nuclei template, and no exploit code or known threat actor campaign are associated with CVE-2026-57224 in the provided data. EPSS has not yet been scored by FIRST.org; no EPSS value is fabricated here.