CVE-2026-57224: Suricata Network IDS DOS Vulnerability

CVE-2026-57224 Overview

CVE-2026-57224 is a resource exhaustion vulnerability [CWE-400] in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation. Versions from 8.0.0 up to (but not including) 8.0.6 are affected. The Dynamic Host Configuration Protocol (DHCP) parser in rust/src/dhcp/dhcp.rs and the Remote Desktop Protocol (RDP) parser in rust/src/rdp/rdp.rs create stateless transactions without recording packet direction. Sensors observing only one traffic direction cannot free completed transactions, causing per-flow transaction lists to grow unbounded and exhaust CPU and memory.

Critical Impact
An attacker on an adjacent network can send crafted DHCP or RDP traffic to a Suricata sensor observing only one traffic direction, triggering unbounded transaction accumulation that exhausts CPU and memory and disables the monitoring engine.

Affected Products

Suricata 8.0.0 through 8.0.5 (DHCP parser in rust/src/dhcp/dhcp.rs)
Suricata 8.0.0 through 8.0.5 (RDP parser in rust/src/rdp/rdp.rs)
Suricata deployments monitoring asymmetric or single-direction traffic flows

Discovery Timeline

2026-09-18 - CVE-2026-57224 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57224

Vulnerability Analysis

Suricata processes application-layer protocols by creating transactions that track request and response state per flow. Each transaction should record which packet direction it belongs to, allowing the engine to mark the opposite direction as inspected and free the transaction when complete.

The DHCP parser in rust/src/dhcp/dhcp.rs and the RDP parser in rust/src/rdp/rdp.rs create stateless transactions without calling AppLayerTxData::for_direction(). This omission prevents Suricata from associating each transaction with a specific direction. When a sensor observes only one direction of traffic, the engine never receives the opposite-direction signal required to complete and free the transaction.

The per-flow transaction list grows without bound as new packets arrive. Cleanup routines repeatedly scan the growing list, producing quadratic work over time. CPU and memory consumption climb until the sensor becomes unresponsive.

Root Cause

The root cause is missing direction metadata on transaction creation in two Rust protocol parsers. Without AppLayerTxData::for_direction(), transactions remain in a permanently incomplete state on asymmetric flows. The transaction list is never pruned, and cleanup scanning cost grows linearly with the list size.

Attack Vector

Exploitation requires adjacent network access. An attacker sends crafted DHCP broadcasts or RDP connection traffic that the Suricata sensor observes in only one direction. This condition occurs naturally in taps, SPAN ports with asymmetric routing, or unidirectional monitoring designs. Repeated traffic accumulates transactions per flow until the sensor exhausts resources.

rust

// Patch context in rust/src/dhcp/dhcp.rs
// Source: https://github.com/OISF/suricata/commit/3f86c56c800392ede5cfaf7a944a431fd8445c55
-/* Copyright (C) 2018-2021 Open Information Security Foundation
+/* Copyright (C) 2018-2026 Open Information Security Foundation

// Patch context in rust/src/applayer.rs (bac8a69) exposing the flags field
// so parsers can mark transactions single-directional:
-    flags: u8,
+    pub flags: u8,

The fixes mark DHCP and RDP transactions as single-directional so Suricata can complete and free them without waiting for a response direction that will never arrive. Refer to Suricata Pull Request #15740 for the full patch set.

Detection Methods for CVE-2026-57224

Indicators of Compromise

Steadily increasing memory (RSS) consumption of the suricata process over hours or days without a corresponding rise in monitored throughput.
Rising CPU utilization on Suricata worker threads correlated with DHCP or RDP traffic volume.
Suricata stats.log entries showing growing app_layer.tx counts for dhcp or rdp without matching completion counts.
Packet drops or capture.kernel_drops increases as the sensor falls behind.

Detection Strategies

Monitor Suricata eve.json stats events for unbounded growth in per-protocol transaction counters for dhcp and rdp.
Alert on Suricata process memory exceeding a defined baseline threshold over a rolling window.
Inventory sensor deployments to identify locations where traffic capture is asymmetric or unidirectional.

Monitoring Recommendations

Ingest Suricata stats.log and eve.json into a centralized logging or SIEM platform and build dashboards for transaction lifecycle metrics.
Correlate host-level resource metrics (CPU, memory, packet drops) with application-layer transaction counts.
Track Suricata version inventory to confirm all sensors are running 8.0.6 or later.

How to Mitigate CVE-2026-57224

Immediate Actions Required

Upgrade all Suricata sensors from any 8.0.x release prior to 8.0.6 to version 8.0.6 or later.
Identify sensors monitoring asymmetric or one-directional traffic and prioritize them for the upgrade.
Restart Suricata after upgrade to clear any accumulated transaction state.

Patch Information

The issue is fixed in Suricata Release 8.0.6. The corrective changes are tracked in GitHub Security Advisory GHSA-m2vc-g65c-ph7m and Open Information Security Foundation Issue #8621. Relevant commits include 3f86c56, bac8a69, 5af13e3, and ef035c76.

Workarounds

Disable the DHCP and RDP application-layer parsers in suricata.yaml if upgrading is not immediately possible.
Reconfigure capture points to provide bidirectional visibility so transactions can complete and be freed.
Apply upstream network filtering to limit exposure of the sensor to untrusted DHCP or RDP traffic.

bash

# Disable DHCP and RDP parsers in suricata.yaml as a temporary workaround
app-layer:
  protocols:
    dhcp:
      enabled: no
    rdp:
      enabled: no

# Verify installed version after upgrade
suricata --build-info | head -n 1
# Expected: This is Suricata version 8.0.6 RELEASE