CVE-2026-57227: Suricata MQTT Parser DOS Vulnerability

CVE-2026-57227 Overview

CVE-2026-57227 is a resource exhaustion vulnerability [CWE-400] in the Suricata network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw resides in the MQTT parser located at rust/src/mqtt/mqtt.rs. The parser permits repeated PUBREC or PUBREL messages to be appended to a single transaction without any upper bound. Attackers can send crafted MQTT traffic that causes transaction state to grow indefinitely, consuming CPU and memory on the Suricata sensor. This condition results in slowdown or full denial of service of the network monitoring engine. The Open Information Security Foundation (OISF) fixed the issue in Suricata versions 7.0.17 and 8.0.6.

Critical Impact
Remote, unauthenticated attackers can exhaust CPU and memory on Suricata sensors by sending crafted MQTT traffic, degrading or disabling network monitoring capabilities.

Affected Products

Suricata versions 7.0.0 through 7.0.16
Suricata versions 8.0.0 through 8.0.5
Deployments using the MQTT application-layer parser

Discovery Timeline

2026-09-18 - CVE-2026-57227 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57227

Vulnerability Analysis

The vulnerability affects the Message Queuing Telemetry Transport (MQTT) parser in Suricata. MQTT uses a Quality of Service (QoS) 2 handshake that involves PUBREC (publish received) and PUBREL (publish release) control packets. Suricata tracks these messages as part of a single transaction to maintain protocol state.

The parser did not enforce a maximum number of messages per transaction. An attacker able to reach a monitored MQTT flow could repeatedly send PUBREC or PUBREL packets, each appended to the same transaction structure. Transaction state grows without bound, consuming memory and CPU cycles inside the Rust-based application-layer parser. Because Suricata is often deployed inline as an IPS or on high-throughput monitoring taps, sensor degradation can create blind spots across the monitored network.

Root Cause

The root cause is the absence of a bounds check on message count per MQTT transaction in rust/src/mqtt/mqtt.rs. While a MQTT_MAX_TX constant limited transactions, no corresponding MQTT_MAX_MSGS constant existed to cap messages appended to an individual transaction. This maps to CWE-400: Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires network access to a flow inspected by a vulnerable Suricata sensor. The attacker sends a crafted MQTT session that repeats PUBREC or PUBREL packets indefinitely. No authentication or user interaction is required on the Suricata host itself.

rust

// Patch excerpt from rust/src/mqtt/mqtt.rs
static mut MQTT_MAX_TX: usize = 1024;

+static mut MQTT_MAX_MSGS: usize = 1024;
+
pub(super) static mut ALPROTO_MQTT: AppProto = ALPROTO_UNKNOWN;

Source: Suricata Commit 03ba8a71

The fix introduces a new MQTT_MAX_MSGS limit of 1024 messages per transaction, preventing unbounded state growth.

Detection Methods for CVE-2026-57227

Indicators of Compromise

Sustained high CPU or memory consumption by the suricata process without corresponding traffic volume increase
MQTT flows containing abnormally repeated PUBREC (packet type 5) or PUBREL (packet type 6) control packets
Suricata engine slowdown, dropped packets, or gaps in eve.json event output during MQTT activity

Detection Strategies

Enable the new Suricata rule sid:2229011 (SURICATA MQTT too many messages) after upgrading, as shown in the patched mqtt-events.rules
Monitor Suricata stats.log for growth in app_layer.tx.mqtt counters that outpace flow counts
Correlate MQTT broker logs with Suricata telemetry to identify sessions producing excessive QoS 2 handshake packets

Monitoring Recommendations

Track sensor health metrics (CPU, RSS memory, packet drop rate) and alert on sustained deviations
Baseline normal MQTT transaction sizes in monitored environments and alert on outliers
Forward Suricata eve.json and stats data to a centralized analytics platform for cross-sensor correlation

How to Mitigate CVE-2026-57227

Immediate Actions Required

Upgrade Suricata to version 7.0.17 or 8.0.6 on all sensors running the 7.0.x or 8.0.x branches
Inventory all Suricata deployments and confirm the MQTT parser is enabled where MQTT is in scope
Verify sensor redundancy so that a single degraded sensor does not create monitoring blind spots

Patch Information

OISF released fixes in Suricata 7.0.17 and Suricata 8.0.6. The core fix is documented in GitHub Security Advisory GHSA-7h2h-hpj2-9w6p and tracked as OISF Issue #8525. Patch commits include 03ba8a71, 5cde93de, and c03666d2.

Workarounds

If immediate upgrade is not possible, disable the MQTT application-layer parser in suricata.yaml where MQTT inspection is not required
Restrict MQTT broker exposure using network segmentation and firewall rules to limit reachable attack surface
Deploy resource limits (cgroups, systemd MemoryMax) on the Suricata process to contain runaway memory growth

bash

# suricata.yaml - disable MQTT parser as a temporary workaround
app-layer:
  protocols:
    mqtt:
      enabled: no