CVE-2026-57225: Suricata IDS Buffer Overflow Vulnerability

CVE-2026-57225 Overview

CVE-2026-57225 is a null pointer dereference vulnerability in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The flaw resides in src/datasets-context-json.c, which assumes that a configured JSON or NDJSON dataset value_key always resolves to a string. When a dataset or rule feed contains a non-string value for that key, Suricata dereferences a NULL pointer and crashes during startup, configuration test mode, or rule reload — before any traffic is processed. The issue affects versions 8.0.0 through 8.0.5 and is fixed in 8.0.6.

Critical Impact
A malformed or malicious JSON/NDJSON dataset feed can crash Suricata before traffic inspection begins, disabling network detection and prevention coverage.

Affected Products

Suricata 8.0.0 through 8.0.5
Deployments consuming JSON or NDJSON datasets via datajson rule keywords
IDS/IPS environments that hot-reload rules containing dataset feeds

Discovery Timeline

2026-09-18 - CVE-2026-57225 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57225

Vulnerability Analysis

The vulnerability is a classic NULL pointer dereference [CWE-476] in Suricata's datajson implementation. The datajson feature allows detection rules to match against structured JSON or NDJSON datasets loaded at engine initialization. Within src/datasets-context-json.c, the parser looks up the configured value_key inside each JSON object and passes the resulting Jansson json_t * object directly to json_string_value(), which returns NULL if the underlying object is not a string.

The code path did not validate the type of the returned object before use, so any downstream string operation on the NULL result terminates the Suricata process. Because the parser executes during startup, -T configuration test mode, and live rule reload, a single non-string entry in a dataset breaks the detection pipeline before traffic inspection can resume.

Root Cause

The root cause is missing input type validation on JSON dataset values. The parser assumed a trusted schema for the value_key field, but neither trusted operator-supplied datasets nor externally curated rule feeds are guaranteed to hold string values. Any integer, boolean, array, object, or null value at that key triggers the crash.

Attack Vector

Exploitation requires an attacker or careless maintainer to influence the contents of a JSON/NDJSON dataset that Suricata loads. The attack surface is local to the sensor host, and the impact is limited to availability of the IDS/IPS engine. Environments that automatically pull community rule feeds or shared threat intelligence datasets are most exposed, since a single malformed record silently disables detection at the next reload.

// Patch: src/datasets-context-json.c — validate JSON value type before use
     }
 
     *found = true;
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
 
     const char *val_key = json_string_value(key);
     if (val_key == NULL) {

Source: OISF/suricata commit 3ca2ed2

Detection Methods for CVE-2026-57225

Indicators of Compromise

Suricata process termination coinciding with a rule reload (SIGUSR2) or service restart
Log entries containing FatalErrorOnInit referencing a dataset: name after applying the 8.0.6 patch
Gaps in eve.json flow, alert, or stats output aligned with dataset update timestamps
Configuration test mode (suricata -T) exiting non-zero after a dataset feed update

Detection Strategies

Monitor Suricata stats.log and systemd journal for unexpected engine exits during rule reload windows
Validate every JSON/NDJSON dataset with a schema check that enforces string values for the configured value_key before deployment
Alert on divergence between expected and observed Suricata uptime on IDS/IPS sensors

Monitoring Recommendations

Forward Suricata service logs and process-exit telemetry to a centralized analytics platform for correlation
Track rule and dataset feed changes in version control and alert on non-string value_key entries during CI validation
Instrument sensor availability checks so that a crashed Suricata instance triggers on-call notification within minutes

How to Mitigate CVE-2026-57225

Immediate Actions Required

Upgrade all Suricata deployments to version 8.0.6 or later
Audit existing JSON and NDJSON dataset files for non-string values at the configured value_key
Run suricata -T after every dataset or rule feed update to catch fatal parse errors before promoting configuration to production

Patch Information

The fix is committed in 3ca2ed25a324597a85a2ab11595c3b0689468ea5 and bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53 and released in Suricata 8.0.6. Details are published in GitHub Security Advisory GHSA-vqqx-88xw-qqvc and tracked in OISF Redmine Issue #8624. The patch adds an explicit json_is_string() check and emits a FatalErrorOnInit message identifying the offending dataset name.

Workarounds

Restrict write access to dataset source files and pin trusted feed versions until 8.0.6 is deployed
Pre-validate JSON/NDJSON feeds with a linter such as jq to confirm string-typed value_key fields
Disable datajson rules that rely on external feeds where upgrade is not immediately possible

bash

# Validate that every value_key entry in an NDJSON dataset is a string
jq -e 'select((.value_key | type) != "string") | .' dataset.ndjson \
  && echo "Non-string value_key detected — do NOT load into Suricata" \
  || echo "Dataset OK"

# Confirm installed Suricata version is patched
suricata --build-info | grep -i '^This is Suricata version'