CVE-2026-71855: Suricata IDS Auth Bypass Vulnerability

CVE-2026-71855 Overview

CVE-2026-71855 affects Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The flaw resides in src/flow-hash.c, where the flow comparison logic can treat an IPv4 packet and an IPv6 packet as belonging to the same flow. When their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align, Suricata omits an IP family check. An IPv6 packet can therefore reuse IPv4 flow state, or the reverse. Attackers can leverage this incorrect flow classification to trigger detection bypass, IP-only bypass, or incorrect flowbit state. The issue is fixed in Suricata versions 7.0.17 and 8.0.6.

Critical Impact
Attackers can bypass IDS/IPS detection rules by crafting traffic that causes IPv4 and IPv6 flows to collide in the same hash bucket, allowing malicious traffic to evade inspection.

Affected Products

Suricata versions prior to 7.0.17 (7.x branch)
Suricata versions prior to 8.0.6 (8.x branch)
Deployments using IDS, IPS, or NSM modes with dual-stack IPv4/IPv6 traffic

Discovery Timeline

2026-09-18 - CVE-2026-71855 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-71855

Vulnerability Analysis

The vulnerability is an incorrect comparison flaw ([CWE-697]) in Suricata's flow tracking subsystem. Suricata maintains a hash table of active flows so incoming packets can be associated with their session state. The comparison function in src/flow-hash.c checks source and destination addresses, ports, protocol, VLAN, recursion level, and live device, but does not verify that both entries belong to the same IP address family.

Because IPv4 addresses (32 bits) are stored in the same underlying address union as IPv6 addresses (128 bits), a crafted IPv6 packet whose leading 32-bit word matches an existing IPv4 flow's address can hash to the same bucket and pass the comparison. Suricata then attaches the packet to the wrong flow, corrupting stateful detection logic, flowbit values, and IP-only rule tracking.

Root Cause

The root cause is a missing address family check in CmpFlowPacket and related comparators. The pre-patch code relied on CmpAddrsAndPorts operating on raw 32-bit words without asserting that p->src.family matched FLOW_IS_IPV4(f). Any collision on the compared fields caused an IPv6 packet to be bound to an IPv4 flow entry, or vice versa.

Attack Vector

An attacker on the network can send crafted IPv6 packets designed to collide with legitimate IPv4 flow state on a monitored segment. The attack requires no authentication and no user interaction, but successful exploitation depends on knowledge or prediction of hash bucket alignment, making the attack complexity high. Once flow confusion occurs, subsequent malicious packets can bypass signature rules that depend on established flow state or flowbit conditions.

// Patch: src/flow-hash.c - flow: check ip family when comparing
    const uint32_t *p_dst = p->dst.address.address_un_data32;
    return CmpAddrsAndPorts(f_src, f_dst, f->sp, f->dp, p_src, p_dst, p->sp, p->dp) &&
           f->proto == p->proto && f->recursion_level == p->recursion_level &&
-          CmpVlanIds(f->vlan_id, p->vlan_id) && (f->livedev == p->livedev || g_livedev_mask == 0);
+          CmpVlanIds(f->vlan_id, p->vlan_id) &&
+          ((p->src.family == AF_INET) == FLOW_IS_IPV4(f)) &&
+          (f->livedev == p->livedev || g_livedev_mask == 0);
}

Source: Suricata commit 181b3b2

Additional related fixes were applied in commit 4e2f23d and commit bc41dcc, each adding a PacketIsIPv4(p) == FLOW_IS_IPV4(f) guard to their respective comparators.

Detection Methods for CVE-2026-71855

Indicators of Compromise

Suricata eve.json flow records showing sudden protocol or address-family transitions on the same flow_id
Alerts firing inconsistently on repeated identical malicious payloads across dual-stack traffic
Unexpected flowbit state carryover between distinct client sessions on high-traffic sensors
Suricata engine version prior to 7.0.17 or 8.0.6 reported via suricata --build-info

Detection Strategies

Audit deployed Suricata sensors and compare reported versions against the fixed releases 7.0.17 and 8.0.6
Correlate IDS alert gaps with periods of high IPv6 traffic volume on dual-stack segments
Replay packet captures against a patched Suricata instance and compare alert output to the production sensor

Monitoring Recommendations

Enable and centralize Suricata flow, alert, and stats EVE outputs for anomaly review
Monitor for unusual growth in flow-hash collisions using Suricata's internal counters
Ingest Suricata telemetry into a centralized analytics platform, such as a security data lake, to correlate IDS behavior with endpoint and identity signals

How to Mitigate CVE-2026-71855

Immediate Actions Required

Upgrade all Suricata 7.x sensors to version 7.0.17
Upgrade all Suricata 8.x sensors to version 8.0.6
Verify the upgrade with suricata --build-info and reload rulesets after the restart
Review recent alert history on dual-stack segments for evidence of bypassed detections

Patch Information

OISF released fixes in Suricata 7.0.17 and 8.0.6. The changes add an address-family check to flow comparison in src/flow-hash.c. Full advisory details are available in GHSA-fvwh-wjcq-2586 and OISF issue #8558.

Workarounds

No official workaround exists; upgrading to a patched release is the only supported remediation
Where patching is delayed, restrict monitored segments to a single IP family to reduce collision opportunity
Increase alert corroboration by pairing Suricata with a secondary detection source such as endpoint or network telemetry

bash

# Verify Suricata version after upgrade
suricata --build-info | grep -E 'Suricata version|Features'

# Example package upgrade (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade suricata

# Reload rules and confirm engine restart
sudo systemctl restart suricata
sudo suricatasc -c reload-rules