CVE-2026-45766

highpriority · track · 0EPSS 0.006 · 49 %ileRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.62% (49th) EPSS

CVSS 7.5 · high

Is it mine?

6 products

Check your exposure

Who says so?

2 sources

fstec_bdu · nvd

EPSS · scored 2026-10-27

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-770USCWE-770US

affected products (6)

Products and version ranges known to be affected.

Open Information Security Foundation Suricata≤ 7.0.16fstec_bduRU
Open Information Security Foundation Suricata≤ 8.0.5fstec_bduRU
АО «Лаборатория Касперского» Kaspersky Industrial CyberSecurity for Networks≤ 4.3.0.231fstec_bduRU
АО «Лаборатория Касперского» Kaspersky Industrial CyberSecurity for Networks≤ 4.0.1.222fstec_bduRU
oisf suricata7.0.0 → 7.0.16nvdUScpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*
oisf suricata8.0.0 → 8.0.5nvdUScpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu nvd NVD CVE.org MITRE

published 2026-09-10modified 2026-09-16

references (3) nvd

External citations — patches, advisories, analysis.

https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315Release NotesVendor Advisory
https://github.com/OISF/suricata/security/advisories/GHSA-jqr4-ch38-wvm6Third Party Advisory
https://redmine.openinfosecfoundation.org/issues/8418Permissions Required

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan