CVE-2026-22259 Details
Description
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).
A denial-of-service vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, prior to versions 8.0.3 and 7.0.14. When processing specially crafted DNP3 traffic, Suricata can consume excessive amounts of memory. This memory exhaustion can slow down the Suricata process, cause it to run out of memory, and potentially lead to the process being terminated by the OOM killer.
Users can upgrade to Suricata versions 8.0.3 or 7.0.14, both of which include the necessary patch. Alternatively, the DNP3 parser can be disabled in the Suricata YAML configuration file, although this option is turned off by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oisf suricata | < 7.0.14 >= 8.0.0, < 8.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 30, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | New CVE Received | [email protected] |