CVE-2026-57226
mediumpriority · track · 24EPSS 0.006 · 48 %ileUSEPSS · scored 2026-10-27
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
sources
Which sources assert this record, and when.
references (8) nvd
External citations — patches, advisories, analysis.
- https://github.com/OISF/suricata/commit/82af0aeb7cec39e206a9ca96c4966425eddeaa74Patch
- https://github.com/OISF/suricata/commit/b63224871b0f8b0b1f7b8c22d05ba8a5c5f69fbbPatch
- https://github.com/OISF/suricata/commit/d9fae18432501674338e28bd33e35788c95d4a98Patch
- https://github.com/OISF/suricata/pull/15704Patch
- https://github.com/OISF/suricata/releases/tag/suricata-7.0.17Release Notes
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6Release Notes
- https://github.com/OISF/suricata/security/advisories/GHSA-p33j-r48q-3jcfMitigationVendor Advisory
- https://redmine.openinfosecfoundation.org/issues/8642ExploitIssue TrackingThird Party Advisory
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan