CVE-2026-46352: Suricata IDS/IPS DOS Vulnerability

CVE-2026-46352 Overview

CVE-2026-46352 is a deadlock vulnerability in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine maintained by the Open Information Security Foundation (OISF). The flaw affects the IP defragmentation code path when it processes fragmented traffic that carries an encapsulated tunnel protocol whose payload is itself fragmented. Attackers can send crafted fragmented traffic across the network to trigger the deadlock, halting packet inspection and creating a denial-of-service condition. Versions 8.0.0 through 8.0.4 are affected. Version 8.0.5 contains the fix.

Critical Impact
A remote attacker can send crafted fragmented tunneled traffic that deadlocks Suricata's defragmentation engine, stopping traffic inspection and blinding downstream IDS/IPS controls.

Affected Products

Suricata 8.0.0 through 8.0.4
Open Information Security Foundation (OISF) Suricata IDS/IPS/NSM engine
Deployments processing encapsulated tunnel protocols (for example GRE, IP-in-IP, Geneve) with fragmented payloads

Discovery Timeline

2026-09-16 - CVE-2026-46352 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-46352

Vulnerability Analysis

The defect resides in Suricata's IP defragmentation subsystem. When Suricata reassembles a fragmented IP packet that encapsulates a tunnel protocol, and that inner tunneled packet is itself fragmented, the reassembly logic can enter a deadlock state. Once the deadlock is triggered, worker threads responsible for packet processing stall, and Suricata stops inspecting traffic on the affected paths.

The issue is tracked as [CWE-833: Deadlock]. Because Suricata is frequently deployed inline as an IPS or in passive tap mode as an IDS, an unrecoverable deadlock directly translates into loss of protective coverage and monitoring visibility. Recovery typically requires operator intervention to restart the process.

Root Cause

The root cause is improper lock ordering or lock retention within the defragmentation tracker when a fragmented outer packet contains a tunneled inner packet that also requires fragment tracking. The nested defragmentation path re-enters synchronization primitives already held for the outer flow, producing a circular wait between the two reassembly contexts. Full technical details are described in the GitHub Security Advisory and the corresponding Open Information Security Foundation issue tracker.

Attack Vector

Exploitation requires only network access to a segment inspected by a vulnerable Suricata sensor. The attacker does not need authentication or user interaction. By emitting IP fragments that carry a tunnel protocol whose inner payload is also fragmented, an attacker can induce the deadlock and degrade or disable inspection. No public exploit code is currently listed for this issue.

No verified code examples are available. See the Suricata release announcement for maintainer commentary on the fix.

Detection Methods for CVE-2026-46352

Indicators of Compromise

Suricata worker threads that stop advancing packet counters while the interface continues to receive traffic.
Sudden drop of stats.log counters for decoder.ipv4, decoder.ipv6, or defrag.ipv4.reassembled while capture.kernel_packets continues to grow.
Unexpected growth in kernel drop counters (capture.kernel_drops) on sensor interfaces coinciding with fragmented tunneled traffic.

Detection Strategies

Query the Suricata management socket (suricatasc -c uptime and suricatasc -c iface-stat) on a schedule and alert when packet processing rates flatline.
Compare inspected packet volume against interface capture volume; a persistent divergence indicates a stalled pipeline consistent with this deadlock.
Inspect NetFlow or packet broker telemetry for atypical volumes of fragmented traffic carrying GRE, IP-in-IP, or Geneve encapsulation directed at sensor-visible segments.

Monitoring Recommendations

Forward Suricata eve.json and stats.log into a centralized analytics platform and build dashboards on decoder and defrag counter deltas.
Configure watchdog alerts that page on-call staff when a Suricata sensor stops writing events for a defined interval.
Correlate sensor health telemetry with upstream firewall and router fragmentation counters to detect targeted fragmentation floods.

How to Mitigate CVE-2026-46352

Immediate Actions Required

Upgrade every Suricata instance running 8.0.0 through 8.0.4 to version 8.0.5 or later.
Inventory sensors and management appliances that embed Suricata to confirm the packaged engine version.
Enable process supervision (systemd restart policies or equivalent) so a deadlocked sensor is restarted while patching is scheduled.

Patch Information

The Open Information Security Foundation released Suricata 8.0.5, which contains the fix for CVE-2026-46352. Details are published in the Suricata 8.0.5 release announcement and the GHSA-rc34-46x6-mxxm advisory. Operators should validate rule and configuration compatibility in a staging environment before rolling the upgrade to production sensors.

Workarounds

No workarounds are available according to the vendor advisory; upgrading to 8.0.5 is required.
As a compensating control, deploy redundant sensors on separate hosts so a single deadlocked instance does not eliminate inspection coverage.
Where feasible, drop or reassemble fragmented tunnel traffic at an upstream device before it reaches the Suricata sensor.

bash

# Verify the running Suricata version and upgrade path
suricata --build-info | head -n 1
# Expected output after remediation: "This is Suricata version 8.0.5" or later