CVE-2026-57226

Executive Summary

CVE-2026-57226 is an integer-related heap buffer overflow vulnerability in the Suricata network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. It affects Suricata versions prior to 7.0.17 and 8.0.6 when the non-default HTTP SWF decompression feature (swf-decompression) is enabled with an unsafe decompress-depth configuration. A crafted SWF response can cause Suricata to allocate memory based on the configured depth rather than the Flash file's actual data requirement, leading to a heap buffer overflow and daemon crash (availability impact only).

Technical Analysis

The vulnerability resides in src/util-file-decompression.c, where Suricata handles HTTP SWF (Shockwave Flash) decompression. When the non-default swf-decompression feature is enabled and a non-safe decompress-depth is configured, the code uses the configured depth value when allocating memory instead of limiting the allocation to the actual data requirement of the Flash file being processed. This mismatch between the allocated buffer size and the actual data written constitutes a classic integer-related heap buffer overflow (CWE-122).

The attack surface is the HTTP protocol parser, specifically the SWF decompression routine that processes HTTP responses containing compressed SWF content. Because Suricata operates inline (IPS) or passively (IDS/NSM) on network traffic, an attacker who can deliver a crafted HTTP response to a monitored network segment can trigger the flaw. The default configuration is not affected: the swf-decompression feature is disabled by default, and the default decompress-depth setting is safe. This significantly limits the population of vulnerable deployments to those operators who have explicitly enabled SWF decompression and tuned the depth to an unsafe value.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that the attack is network-reachable, requires high complexity (the non-default configuration prerequisite and the precise crafting needed to hit the overflow), needs no privileges or user interaction, and results only in a low availability impact via crash. There is no confidentiality or integrity impact because the overflow occurs in a parsing utility that does not process the attacker's data beyond the crash boundary, and no code execution has been demonstrated.

The root cause is an allocation-size calculation error: the configured decompression depth is treated as a trustworthy bound for buffer sizing, but the actual decompressed output driven by the Flash file content can exceed that assumption, or the integer used in the size calculation can wrap/under-allocate relative to the write length. The fix in 7.0.17 and 8.0.6 corrects the allocation logic so that buffer sizing is bounded by the Flash file's actual data requirement rather than the configured depth.

No public proof-of-concept, Nuclei template, or exploit code is currently available. EPSS has not yet scored this CVE, and there is no CISA KEV listing. The attack chain below is inferred at the vulnerability-class level from the NVD description.

Exploitation Scenarios

No public PoC is available for CVE-2026-57226; the following chain is inferred from the vulnerability class (integer-related heap buffer overflow in SWF decompression) and the NVD description.

1. Reconnaissance/target identification: An adversary identifies a network segment monitored or protected by a Suricata deployment. The adversary must determine (or assume) that the target's Suricata instance has the non-default swf-decompression feature enabled and a decompress-depth configured to an unsafe value. Because this configuration is non-default, the attacker generally cannot confirm it remotely; the attack is therefore opportunistic against a limited population, consistent with the High attack complexity rating.

2. Triggering the specific flaw class: The adversary arranges for a crafted HTTP response containing SWF (Flash) content to traverse the Suricata inspection path. Suricata's HTTP parser routes the SWF payload into src/util-file-decompression.c. When decompression is enabled and the configured depth is unsafe, the routine allocates a heap buffer using the configured depth value rather than limiting the allocation to the Flash file's actual data requirement.

3. Payload/execution method at the vulnerability-class level: The SWF content is crafted so that the decompressed data written into the undersized buffer exceeds the allocation, producing a heap buffer overflow. In the integer-related variant, the size arithmetic can wrap or otherwise under-allocate, causing the write to spill past the buffer boundary. The result described by NVD is a crash of the Suricata process.

4. Post-exploitation impact: The demonstrated and stated impact is a crash (denial of service / availability loss) of the Suricata daemon. No code execution, data exfiltration, or integrity modification has been demonstrated in the available data. On an inline IPS deployment, a Suricata crash can interrupt traffic inspection and potentially affect the protected link depending on fail-open/fail-closed configuration; the CVSS score nonetheless constrains the assessed impact to Low availability.

Impact Assessment

The primary impact is availability: a successful trigger crashes the Suricata process. On an IDS/NSM sensor, this blinds monitoring for the duration of the outage and may result in lost telemetry. On an inline IPS, a crash may interrupt inspected traffic or fail over depending on deployment mode, potentially disrupting the protected network path. The CVSS subscores are AV:N (network-reachable), AC:H (high complexity, driven by the non-default configuration prerequisite and crafting difficulty), PR:N (no privileges required), UI:N (no user interaction), S:U (unchanged scope), C:N/I:N (no confidentiality or integrity impact), and A:L (low availability impact).

Blast radius is narrow by configuration: only deployments that have enabled the non-default swf-decompression feature and set an unsafe decompress-depth are vulnerable. Default installations are explicitly stated by the vendor to be unaffected. There is no evidence of supply-chain compromise, no threat actor campaign, and no exploit-in-the-wild reporting. The affected population is most likely security-conscious organizations running Suricata with custom feature tuning, and the impact is felt by the defending organization rather than by third parties.

Detection Guidance

Sigma Rule

title: Suricata SWF Decompression Heap Overflow Crash Detection (CVE-2026-57226)
id: 8f4c2a91-1d7e-4b62-9c3a-5e0a7d2b6f11
status: experimental
description: Detects Suricata process crashes correlated with SWF decompression handling, potentially indicating CVE-2026-57226 exploitation on deployments with non-default swf-decompression enabled.
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: suricata
detection:
  selection_crash:
    message|contains:
      - 'suricata'
    message|contains|any:
      - 'Segmentation fault'
      - 'core dumped'
      - 'suricata.*exited'
      - 'heap corruption'
  selection_swf:
    message|contains|any:
      - 'swf'
      - 'decompress'
  condition: selection_crash and selection_swf
falsepositives:
  - Legitimate Suricata restarts or upgrades during maintenance
  - Unrelated memory errors in other Suricata subsystems
level: medium
tags:
  - attack.t1190
  - cve.2026.57226
  - cwe.122

YARA Rule

rule CVE_2026_57226_Suricata_SWF_Decompression_Overflow
{
    meta:
        author = "valtersit.com"
        description = "Detects craftable SWF/FWS/CWS/ZWS HTTP response content that may trigger Suricata SWF decompression heap overflow (CVE-2026-57226). This is a heuristic detection aid, not a PoC."
        cve = "CVE-2026-57226"
        cwe = "CWE-122"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57226"

    strings:
        $swf_fws = "FWS" ascii
        $swf_cws = "CWS" ascii
        $swf_zws = "ZWS" ascii
        $http_ok = "HTTP/" ascii

    condition:
        $http_ok and 1 of ($swf_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-57226 Suricata SWF Decompression Heap Overflow Attempt"; flow:established,to_client; http.content_type; content:"application/x-shockwave-flash"; http.response_body; content:"|46 57 53|"; depth:3; sid:202657226; rev:1; metadata:cve CVE-2026-57226, cwe CWE-122; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-57226;)

Elastic Detection

process where event.type == "end" or event.action == "process_crashed"
  and process.name == "suricata"
  and (
    process.args : "*swf*" or
    process.command_line : "*swf-decompression*" or
    process.command_line : "*decompress-depth*"
  )

Splunk SPL Query

index=suricata (sourcetype="suricata:alert" OR sourcetype="suricata")
  ("swf" OR "decompress" OR "decompression")
  (signature="*SWF*" OR alert.signature="*SWF*" OR message="*decompress*")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(alert.signature) as signatures values(src_ip) as src_ips
    values(dest_ip) as dest_ips by src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen src_ip dest_ip signatures count

Wazuh OSSEC Rule

<group name="suricata,cve-2026-57226,">
  <rule id="202657261" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">alert</field>
    <field name="alert.signature" type="pcre2">(?i)swf|decompress</field>
    <description>CVE-2026-57226: Suricata SWF decompression anomaly detected - possible heap overflow attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_57226,</group>
  </rule>
  <rule id="202657262" level="12">
    <if_sid>202657261</if_sid>
    <field name="alert.severity">1</field>
    <description>CVE-2026-57226: High-severity Suricata SWF decompression alert - investigate potential crash/DoS</description>
    <group>cve_2026_57226,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version array is available from the tracked sources; the version ranges in this report are taken from the NVD description text.

1. Immediate mitigations:

• Ensure the non-default swf-decompression feature is disabled unless operationally required. Default installations are explicitly not affected per the NVD description.
• Where SWF decompression must remain enabled, revert any unsafe decompress-depth tuning to the default or a conservative value rather than an aggressive depth.
• Restrict or filter HTTP responses carrying Shockwave Flash content (application/x-shockwave-flash, FWS/CWS/ZWS magic bytes) on monitored segments where Flash content is not expected.
• On inline IPS deployments, review fail-open/fail-closed behavior and redundancy so a Suricata crash does not translate into a network-wide outage.

2. Patch/upgrade steps:

• Upgrade to Suricata 7.0.17 or 8.0.6, which the NVD description states contain the fix. Note that no independent patch artifact has been confirmed by tracked sources (patch confidence 0/4); validate the fix against the official Suricata release channels before relying on it.
• After upgrading, re-verify the swf-decompression and decompress-depth configuration and confirm the daemon remains stable under representative HTTP traffic.

3. Long-term hardening:

• Maintain an inventory of non-default IDS/IPS feature flags and treat them as expanded attack surface requiring review.
• Enable automated crash detection and restart policies for Suricata (systemd, supervisors) with alerting, so a crash is visible immediately.
• Continuously subscribe to Suricata security advisories and track CVE/CWE classes affecting network parsing utilities such as src/util-file-decompression.c.
• Apply least-privilege and resource limits to the Suricata process to bound the impact of memory-safety failures.

References

• NVD — CVE-2026-57226: https://nvd.nist.gov/vuln/detail/CVE-2026-57226
• CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• Suricata project website and release downloads: https://suricata.io/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-57226 not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign / exploit-in-the-wild evidence: None. No CISA KEV listing, no public proof-of-concept, no Nuclei template, and no exploit code were identified by the tracked sources. EPSS has not yet assigned a score for this CVE.