CVE-2026-57229: Suricata SMTP MIME Parser Info Leak Flaw

CVE-2026-57229 Overview

CVE-2026-57229 is a state management flaw in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The vulnerability resides in the Simple Mail Transfer Protocol (SMTP) Multipurpose Internet Mail Extensions (MIME) parser in rust/src/mime/smtp.rs. Versions from 8.0.0 through 8.0.5 fail to fully reset parser state when processing Content-Type: message/rfc822 encapsulation. Attackers can craft mail that evades detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. The issue is fixed in Suricata 8.0.6.

Critical Impact
Crafted SMTP messages using nested message/rfc822 parts can bypass Suricata content, filename, and URL-based signatures, allowing malicious email attachments to evade IDS/IPS inspection.

Affected Products

Suricata 8.0.0 through 8.0.5
Deployments with SMTP MIME decoding enabled
IDS/IPS rulesets relying on file.data, file.name, and extracted URL keywords

Discovery Timeline

2026-09-18 - CVE-2026-57229 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57229

Vulnerability Analysis

The flaw is an incomplete initialization issue [CWE-665] in the SMTP MIME parser. When Suricata encounters a Content-Type: message/rfc822 boundary, the parser transitions into the inner encapsulated message without resetting all state fields tied to the outer MIME part. Fields controlling transfer encoding, filename tracking, decoder instance, and content type remain populated from the previous context.

As a result, the inner message inherits stale metadata. Data extraction primitives such as file.data, file.name, and URL extraction operate on inconsistent decoded content. An attacker who structures a multipart email with a benign outer part and a malicious message/rfc822 inner part can cause Suricata to mis-decode or mis-attribute the payload. Signatures written against attachment content, filenames, or embedded URLs fail to match.

Root Cause

The MimeStateSMTP structure lacked a consolidated restart routine. Individual fields including state_flag, headers, encoding, decoder, filename, bufeolen, content_type, and decoded_line were not uniformly cleared at the message/rfc822 boundary. The fix introduces an impl MimeStateSMTP<'_>::restart() method that resets every relevant field before parsing the encapsulated message.

Attack Vector

Exploitation requires only that an attacker send a crafted SMTP message across a monitored network segment. No authentication or user interaction with the sensor is needed. The vulnerability targets the detection engine itself rather than a target host, and the impact is loss of detection integrity.

rust

// Suricata 8.0.6 patch: consolidated MimeStateSMTP restart function
// rust/src/mime/smtp.rs
     pub(crate) md5_result: String,
 }

+impl MimeStateSMTP<'_> {
+    fn restart(&mut self) {
+        self.state_flag = MimeSmtpParserState::MimeSmtpStart;
+        self.headers.truncate(self.main_headers_nb);
+        self.encoding = MimeSmtpEncoding::Plain;
+        self.decoder = None;
+        self.filename.clear();
+        self.bufeolen = 0;
+        self.content_type = MimeSmtpContentType::Message;
+        self.decoded_line.clear();
+    }
+}
+
 pub fn mime_smtp_state_init(
     files: &mut FileContainer, sbcfg: *const StreamingBufferConfig,
 ) -> Option<MimeStateSMTP<'_>> {

Source: OISF/suricata commit 4985eb9

Detection Methods for CVE-2026-57229

Indicators of Compromise

SMTP traffic containing multipart MIME messages with nested Content-Type: message/rfc822 parts
Emails where outer and inner MIME parts declare mismatched Content-Transfer-Encoding values (for example, base64 outer, 7bit inner)
Inner encapsulated messages carrying attachments with Content-Disposition filenames that do not appear in Suricata file_store output
Suricata eve.jsonsmtp events lacking expected fileinfo records for observed attachments

Detection Strategies

Query the Suricata version currently deployed on each sensor and flag any installation in the 8.0.0 through 8.0.5 range
Correlate mail gateway logs against Suricata fileinfo events to identify attachments delivered but not parsed by the sensor
Add secondary inspection at the mail transfer agent (MTA) or secure email gateway to validate content that Suricata processed with SMTP MIME decoding enabled

Monitoring Recommendations

Enable verbose smtp and files logging in suricata.yaml to capture per-part MIME metadata for later review
Ship Suricata eve.json output to a central analytics platform and alert on SMTP sessions with nested message/rfc822 structures
Track detection coverage metrics after upgrading to 8.0.6 to confirm rules on file.data, file.name, and URL keywords fire on previously evasive samples

How to Mitigate CVE-2026-57229

Immediate Actions Required

Upgrade all Suricata sensors to version 8.0.6 or later
Inventory sensor configurations to confirm which deployments have SMTP MIME decoding enabled and prioritize those for patching
Re-test SMTP detection rules that depend on file.data, file.name, and URL extraction after the upgrade

Patch Information

The fix is available in the Suricata 8.0.6 release. Technical details are documented in GitHub Security Advisory GHSA-ph5p-pm8r-m355 and tracked as OISF Redmine issue #8649. The patch consolidates parser reset logic into MimeStateSMTP::restart() in rust/src/mime/smtp.rs.

Workarounds

Disable SMTP MIME decoding in suricata.yaml until the upgrade to 8.0.6 completes, accepting the loss of MIME-based detection
Route SMTP traffic through a dedicated secure email gateway that performs independent MIME parsing and attachment inspection
Supplement network detection with endpoint-based file inspection on mail servers and recipient hosts

bash

# suricata.yaml: temporary workaround to disable SMTP MIME decoding
app-layer:
  protocols:
    smtp:
      enabled: yes
      mime:
        decode-mime: no
        decode-base64: no
        decode-quoted-printable: no
        extract-urls: no
        body-md5: no

# Verify installed Suricata version after upgrade
suricata --build-info | grep -i version