CVE-2026-57225

Executive Summary

CVE-2026-57225 is a NULL pointer dereference (CWE-476) in Suricata's src/datasets-context-json.c affecting versions 8.0.0 through 8.0.5. The flaw occurs because the code assumes that a configured JSON or NDJSON dataset value_key resolves to a string; a non-string value for that key in a trusted or untrusted dataset or rule feed triggers a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing begins. The impact is limited to availability (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), with exploitation requiring local access and the ability to influence dataset or rule-feed content; no public PoC, exploit code, or CISA KEV listing exists as of this report.

Technical Analysis

Suricata is an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. The vulnerability resides in src/datasets-context-json.c, the source file responsible for context handling of JSON/NDJSON-backed datasets. Per the NVD description, the code assumes that a configured dataset value_key resolves to a string. When a trusted or untrusted dataset or rule feed supplies a non-string value (for example, a numeric, boolean, or nested object value) for that key, the type assumption is violated, resulting in a NULL pointer dereference.

The dereference is triggered during one of three operational phases explicitly named in the description: (1) normal startup, (2) configuration test mode, or (3) rule reload. In all three cases, the crash occurs before traffic processing begins, meaning the engine cannot inspect or block network traffic in that execution context. This is a classic type-confusion-to-NULL-deref pattern: the parser or loader expects a string pointer, receives something else (or a missing field), and dereferences an uninitialized or NULL pointer when attempting string operations on the value.

CWE-476 (NULL Pointer Dereference) is the assigned weakness. The CVSS vector AV:L (Local) and PR:L (Low privileges) indicates that the attacker must already have local access to the host or the ability to place files into dataset/rule-feed paths — this is not a remote, unauthenticated network exploit. The A:L (Availability: Low) subscore reflects degraded or interrupted service availability rather than catastrophic or persistent loss. There is no confidentiality or integrity impact (C:N/I:N/A:L), consistent with a crash-only defect.

Key technical caveats: The NVD description does not name the specific function, the exact parsing routine, or the precise non-string type that triggers the fault. No commit hash, vendor advisory, or patch diff was available in the provided data. Therefore, the precise line-level mechanism cannot be confirmed beyond the described behavior: a non-string value_key value in a JSON/NDJSON dataset causes a NULL pointer dereference at startup, config-test, or reload time.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class (NULL pointer dereference via malformed dataset input) and the exact phases named in the NVD description.

1. Reconnaissance / target identification: An attacker with local access to a Suricata deployment (or the ability to supply content to a dataset or rule feed consumed by it) identifies a host running Suricata 8.0.0–8.0.5. Because exploitation requires local access or content-supply capability, the realistic actor is a local user, a misconfigured downstream feed, or a compromised content pipeline rather than an anonymous remote attacker.

2. Trigger of the specific flaw class: The attacker causes a JSON or NDJSON dataset used by Suricata to contain a non-string value for the configured value_key. Per the description, src/datasets-context-json.c assumes the value_key resolves to a string; when it does not (for example, the key holds a non-string JSON type), the code dereferences a NULL pointer. This is the exact class of defect: an unchecked type assumption leading to a NULL dereference.

3. Payload / execution method at the vulnerability-class level: The malformed value is delivered via a trusted or untrusted dataset or rule feed — i.e., the content file itself is the payload. The trigger fires during startup, configuration test mode, or rule reload, not during live traffic inspection. No shellcode execution or code injection is described; the outcome is a crash (denial of service) rather than arbitrary code execution.

4. Post-exploitation impact: Suricata crashes before it processes traffic. The practical effect is loss of IDS/IPS/NSM coverage on that instance — a monitoring blind spot — until the engine is restarted or the offending dataset content is removed. There is no data exfiltration, no integrity modification, and no privilege escalation described. The availability impact is rated Low.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base score 3.3 (Low). Interpretation of each subscore:

• AV:L — Attack vector is Local; the attacker needs local access or the ability to influence dataset/rule-feed content consumed by the engine.
• AC:L — Attack complexity is Low once access is obtained; no race condition or special conditions are described.
• PR:L — Low privileges are sufficient; no administrative rights are required per the vector.
• UI:N — No user interaction is required.
• S:U — Scope is Unchanged; only the Suricata process is affected.
• C:N / I:N — No confidentiality or integrity impact.
• A:L — Low availability impact: a crash before traffic processing degrades or interrupts the service.

Business impact: For organizations relying on Suricata as a detection/prevention control, the crash creates a monitoring gap. If an attacker can deliberately induce reload or restart with malformed dataset content, they can repeatedly blind or disable the sensor — a denial-of-service condition against the security monitoring plane. The blast radius is limited per-instance (S:U), but in distributed deployments a shared malformed dataset or rule feed could cause multiple sensors to crash at once. Because exploitation requires local access or content-supply control, the real-world reach is constrained, consistent with the Low base score. No KEV listing, no known in-the-wild exploitation, and no threat-actor campaign is documented in the provided data.

Detection Guidance

Sigma Rule

title: Suricata Crash via Non-String Dataset value_key (CVE-2026-57225)
id: 9f3c2a14-7b6e-4d21-a5c8-1e2f4b6a9d30
status: experimental
description: Detects Suricata process crashes/termination correlated with dataset or rule-feed reload/startup, consistent with CVE-2026-57225 NULL pointer dereference.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57225
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_crash:
    type: 'segfault'
    or:
      - exe|endswith: '/suricata'
      - comm: 'suricata'
  selection_msg:
    message|contains:
      - 'suricata'
      - 'datasets-context-json'
  condition: selection_crash or (selection_crash and selection_msg)
falsepositives:
  - Legitimate Suricata crashes unrelated to dataset parsing.
level: medium
tags:
  - attack.impact
  - cve.2026-57225

YARA Rule

rule CVE_2026_57225_Suricata_Dataset_NonString
{
    meta:
        description = "Detects JSON/NDJSON dataset files with non-string value_key values that may trigger CVE-2026-57225 in Suricata < 8.0.6"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57225"
        date = "2026-01-01"
        severity = "low"
    strings:
        $key = "value_key"
        $json_ext = ".json"
        $ndjson_ext = ".ndjson"
    condition:
        ($key and ($json_ext or $ndjson_ext)) or
        (filesize < 5MB and $key and #key > 0)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-57225 Suricata Dataset value_key Malformed Content Transfer"; flow:to_server,established; content:"value_key"; nocase; content:"{"; distance:0; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:2026572250; rev:1;)

Elastic Detection

process where event.action == "end" and process.name == "suricata" and
  (process.exit_code != 0 or process.args : "*dataset*" or process.args : "*reload*")

Splunk SPL Query

index=os OR index=syslog sourcetype=syslog (suricata OR "datasets-context-json") ("segfault" OR "signal 11" OR "SIGSEGV" OR "NULL pointer")
| stats count by host, process, message
| where count > 0

Wazuh OSSEC Rule

<group name="suricata,cve-2026-57225,">
  <rule id="100725" level="7">
    <decoded_as>syslog</decoded_as>
    <match>suricata</match>
    <regex>segfault|signal 11|SIGSEGV|NULL pointer|datasets-context-json</regex>
    <description>CVE-2026-57225: Suricata crash possibly caused by non-string dataset value_key</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no patch available from tracked sources):

• Isolate dataset and rule-feed content: restrict write access to Suricata dataset/JSON/NDJSON and rule-feed directories to trusted administrators only, reducing the local/content-supply attack surface required by AV:L/PR:L.
• Validate dataset content: before loading, scan JSON/NDJSON dataset files to confirm every configured value_key resolves to a string; reject files containing non-string values for that key.
• Avoid triggering reload/startup with unverified dataset content; stage and validate feeds in a non-production config-test environment first.
• Monitor for Suricata process crashes (SIGSEGV) correlated with dataset/rule reload events.

2. Patch / upgrade steps:

• Per the NVD description, the issue is fixed in Suricata 8.0.6. Upgrade any instance running 8.0.0–8.0.5 to 8.0.6 or later.
• No vendor advisory, commit reference, or workaround was present in the provided data; verify the fix against the official Suricata release notes and download source/package from the official Suricata project distribution before deployment.
• Re-validate dataset and rule feeds after upgrade.

3. Long-term hardening:

• Implement strict schema validation for all dataset/NDJSON inputs at ingest time.
• Apply least-privilege file permissions on dataset, rule, and configuration paths.
• Add crash-loop alerting and automatic service supervision (systemd restart with backoff) to limit monitoring downtime.
• Track Suricata security advisories and maintain a rapid upgrade path for IDS/IPS sensors.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57225
• Suricata project (official source/release notes): https://suricata.io/
• CWE-476 NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
• Suricata GitHub repository: https://github.com/OISF/suricata
• CISA KEV catalog (no entry for CVE-2026-57225 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. The provided data indicates no public PoC, no exploit code, no Nuclei template, no CISA KEV listing, and no EPSS score. No threat-actor campaign is documented for CVE-2026-57225.