What is CVE-2026-22258?

CVE-2026-22258 is a high-severity vulnerability in Oisf Suricata, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-01-27.

How severe is CVE-2026-22258?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Oisf Suricata

CVE-2026-22258

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.

Vulnerability class: DoS (Denial of Service)

Published 2026-01-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.006 (44.0th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001

Affected products

Oisf Suricata — versions < 7.0.14, >= 8.0.0, < 8.0.3

Weakness classification (CWE)

References

github.com/OISF/suricata/security/advisories/GHSA-289c-h599-3xcx (Patch, Vendor Advisory)
github.com/OISF/suricata/commit/39d8c302af3422a096b75474a4f295a754ec6a74 (Patch)
github.com/OISF/suricata/commit/f82a388d0283725cb76782cf64e8341cab370830 (Patch)
redmine.openinfosecfoundation.org/issues/8182 (Permissions Required, Issue Tracking)

Frequently asked questions

What is CVE-2026-22258?: CVE-2026-22258 is a high-severity vulnerability in Oisf Suricata, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-01-27.
How severe is CVE-2026-22258?: High severity. CVSS v3 base score is 7.5 out of 10.