CVE-2026-63451: Suricata IDS Buffer Overflow Vulnerability

CVE-2026-63451 Overview

CVE-2026-63451 is a heap buffer overflow [CWE-122] in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. The flaw exists in src/detect-engine-prefilter.c and affects Suricata versions 8.0.0 through 8.0.5. A locally supplied detection rule that combines frame inspection without content and a transformed match without content causes the engine to select multiple non-prefilter frame engines during signature preparation. Loading such a crafted rule, including in test mode, triggers a heap buffer overflow and crashes Suricata. The issue is fixed in Suricata 8.0.6.

Critical Impact
A malformed local detection rule can crash the Suricata engine, disrupting network intrusion detection and prevention coverage until the process is restarted.

Affected Products

Suricata 8.0.0 through 8.0.5
Suricata IDS/IPS deployments loading untrusted or user-authored rule sets
Suricata rule development environments running signatures in test mode

Discovery Timeline

2026-09-18 - CVE-2026-63451 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63451

Vulnerability Analysis

The vulnerability resides in the signature preparation logic of Suricata's detection engine prefilter component. When a detection rule combines frame inspection without a content keyword and a transformed match that also lacks content, the prefilter selection code in src/detect-engine-prefilter.c fails to stop after finding the first non-prefilter frame engine. It then continues iterating and registers multiple non-prefilter frame engines for the same signature. Downstream code assumes a single non-prefilter frame engine per signature, and the mismatch produces a heap buffer overflow during rule loading. The condition is triggered only by loading the crafted rule; network traffic alone cannot reach the flaw.

Root Cause

The root cause is missing loop-termination logic when iterating candidate buffers for non-prefilter frame inspection. Once a frame buffer is selected, additional buffers referencing the same frame combined with transforms are still evaluated and added. This violates the one-non-prefilter-frame-per-signature invariant enforced by the surrounding memory allocations, leading to an out-of-bounds heap write.

Attack Vector

Exploitation requires local access with permission to supply rules to Suricata. An operator or automation pipeline loading the crafted signature, either during normal startup or with the -T test mode option, triggers the crash. There is no network-triggerable path, no data confidentiality or integrity impact, and the outcome is limited to a denial of service against the Suricata process.

                    tx_non_pf = true;
                }
            }
+            if (frame_non_pf) {
+                // we found a frame, do not look for other buffers
+                // which may include the same frame + transform
+                // but we only want 1 per signature
+                break;
+            }
        }
        /* handle hook only rules */
        if (!tx_non_pf && s->init_data->hook.type == SIGNATURE_HOOK_TYPE_APP) {

Source: Suricata Commit 5449ae17. The patch adds an early break after the first non-prefilter frame buffer is selected, ensuring at most one frame engine is registered per signature.

Detection Methods for CVE-2026-63451

Indicators of Compromise

Unexpected Suricata process crashes or segmentation faults during rule loading or suricata -T test runs.
Rule files containing frame keywords without accompanying content matches combined with transform modifiers.
Heap corruption signatures in core dumps referencing DetectEnginePrefilterSetupAppLayer or related prefilter functions.

Detection Strategies

Audit rule repositories and update pipelines for signatures that combine frame inspection and transformed matches without content.
Run suricata -T -c suricata.yaml -S <rule-file> in an isolated environment before deploying new or third-party rule sets to production sensors.
Compare deployed Suricata binary versions against 8.0.6 across sensor fleets and flag hosts running 8.0.0 through 8.0.5.

Monitoring Recommendations

Alert on abnormal Suricata service restarts, SIGSEGV events, and coredump generation on IDS/IPS hosts.
Track configuration management commits that add or modify Suricata rule files, especially from external threat-intel feeds.
Monitor sensor health telemetry for gaps in traffic inspection that correlate with rule reload operations.

How to Mitigate CVE-2026-63451

Immediate Actions Required

Upgrade all Suricata deployments running versions 8.0.0 through 8.0.5 to Suricata 8.0.6.
Restrict write access to Suricata rule directories and configuration files to trusted administrators only.
Validate any new rule set in a non-production environment using test mode before rolling out to sensors.

Patch Information

The fix is delivered in Suricata 8.0.6 via commits 5449ae17 and d62acf5d, merged through Pull Request #15807. Additional context is available in GitHub Security Advisory GHSA-6qwq-j83r-qp34 and OpenInfoSec Issue #8590.

Workarounds

Do not load Suricata rules from untrusted sources on affected versions.
Review existing custom rules and remove combinations of frame keywords with transforms that omit content matches until the patch is applied.
Enforce mandatory suricata -T validation in CI pipelines that publish rules to production sensors.

bash

# Verify installed Suricata version and validate rules before deployment
suricata --build-info | grep -i version
suricata -T -c /etc/suricata/suricata.yaml -S /etc/suricata/rules/local.rules