CVE-2026-45751 PUBLISHED

Suricata detect/transform: use-after-free in dotprefix transform

Assigner: GitHub_M
Reserved: 13.05.2026 Published: 10.09.2026 Updated: 10.09.2026

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing buffer to be reallocated. The issue is reached during a specific network traffic processing, and requires a specific but not malicious rule. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, avoid rules that chain dotprefix transform after another one.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.9

Product Status

Vendor OISF
Product suricata
Versions
  • Version < 7.0.16 is affected
  • Version >= 8.0.0, < 8.0.5 is affected

References

Problem Types

  • CWE-416: Use After Free CWE