CVE-2026-22259

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22259", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T05:19:12.922Z", "datePublished": "2026-01-27T17:13:11.057Z", "dateUpdated": "2026-01-27T18:16:55.422Z"}, "containers": {"cna": {"title": "Suricata dnp3: unbounded transaction growth", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9"}, {"name": "https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e", "tags": ["x_refsource_MISC"], "url": "https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e"}, {"name": "https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942", "tags": ["x_refsource_MISC"], "url": "https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942"}, {"name": "https://redmine.openinfosecfoundation.org/issues/8181", "tags": ["x_refsource_MISC"], "url": "https://redmine.openinfosecfoundation.org/issues/8181"}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"version": "< 7.0.14", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T17:13:11.057Z"}, "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default)."}], "source": {"advisory": "GHSA-878h-2x6v-84q9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T18:16:20.937010Z", "id": "CVE-2026-22259", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T18:16:55.422Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T18:16:20.937010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T18:16:50.763Z"}}], "cna": {"title": "Suricata dnp3: unbounded transaction growth", "source": {"advisory": "GHSA-878h-2x6v-84q9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": "< 7.0.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.3"}]}], "references": [{"url": "https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9", "name": "https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e", "name": "https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942", "name": "https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942", "tags": ["x_refsource_MISC"]}, {"url": "https://redmine.openinfosecfoundation.org/issues/8181", "name": "https://redmine.openinfosecfoundation.org/issues/8181", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T17:13:11.057Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22259", "state": "PUBLISHED", "dateUpdated": "2026-01-27T18:16:55.422Z", "dateReserved": "2026-01-07T05:19:12.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-27T17:13:11.057Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "suricata", "vendor": "OISF", "versions": [{"status": "affected", "version": "< 7.0.14"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "5302B0F0-AF2D-4140-BC66-9186EF7E455D", "versionEndExcluding": "7.0.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7DA8362-52A2-4ACC-83F7-CA2E77AE89C6", "versionEndExcluding": "8.0.3", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default)."}, {"lang": "es", "value": "Suricata es un motor IDS, IPS y NSM de red. Antes de las versiones 8.0.3 y 7.0.14, el tr\u00e1fico especialmente dise\u00f1ado puede hacer que Suricata consuma grandes cantidades de memoria mientras analiza el tr\u00e1fico DNP3. Esto puede provocar que el proceso se ralentice y se quede sin memoria, lo que podr\u00eda llevar a que sea terminado por el OOM killer. Las versiones 8.0.3 o 7.0.14 contienen un parche. Como soluci\u00f3n alternativa, deshabilite el analizador DNP3 en el suricata yaml (deshabilitado por defecto)."}], "id": "CVE-2026-22259", "lastModified": "2026-06-17T10:19:39.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22259", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T18:16:20.937010Z", "version": "2.0.3"}}]}, "published": "2026-01-27T17:16:12.407", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OISF/suricata/commit/50cac2e2465ca211eabfa156623e585e9037bb7e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OISF/suricata/commit/63225d5f8ef64cc65164c0bb1800730842d54942"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-878h-2x6v-84q9"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://redmine.openinfosecfoundation.org/issues/8181"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:03:23.263661+00:00", "value": {"mitigation_remediation": ["Update Suricata to version 8.0.3 or newer, or 7.0.14 or newer.", "If an immediate upgrade is not possible, disable the DNP3 parser in the suricata.yaml configuration file.", "Consider blocking DNP3 traffic at the network perimeter until the service can be patched or the parser is disabled."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects OISF Suricata releases prior to version 8.0.3 and 7.0.14. Any instance running Suricata 7.x older than 7.0.14 or 8.x older than 8.0.3 is at risk.", "description_and_impact": "Suricata's DNP3 parsing routine is vulnerable to an unbounded transaction growth issue where a specially crafted packet sequence can consume excessive memory during parsing. The excessive memory consumption can slow the process and eventually trigger the operating system's out-of-memory killer, causing the Suricata instance to terminate, thereby denying the availability of network monitoring services.", "risk_and_exploitability": "The CVSS v3 score of 7.5 indicates high severity while the EPSS score of less than 1% reflects a very low exploitation probability. The issue is not listed in CISA's KEV catalog. Exploitation requires network visibility; a threat actor can send crafted DNP3 packets to a vulnerable Suricata instance, escalating memory usage without authentication or privileged access."}}}}, "created": "2026-01-27T20:16:32.872505+00:00", "updated": "2026-04-18T02:15:05.881147+00:00", "vendors": ["oisf", "oisf$PRODUCT$suricata"]}