CVE-2026-57228: 
Suricata Schwachstellenanalyse und -minderung

CVE-2026-57228 is a heap out-of-bounds read vulnerability in Suricata's SMTP MIME quoted-printable decoder, affecting versions 7.0.13 through prior to 7.0.17. The flaw can cause Suricata to crash or consume excessive resources when processing crafted network traffic, resulting in a denial of service. It was disclosed on July 21, 2026, and patched in Suricata 7.0.17. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in Suricata's SMTP MIME quoted-printable decoder. Specifically, when a quoted-printable escape sequence is split across two traffic chunks and the subsequent chunk is only one byte long, the decoder reads one byte past the end of a heap-allocated buffer. This flaw is remotely exploitable with no authentication or user interaction required — an attacker simply needs to send crafted SMTP traffic that triggers the boundary condition. The fix is tracked in commit 19880f9d5bbe2b8f8e8867a577848dce2b532c86 targeting the 7.0.17 release (GitHub Advisory, GitHub Commit).

Successful exploitation can crash the Suricata IDS/IPS process, disabling network traffic inspection and alerting capabilities. Because Suricata is commonly deployed as a network security monitor or inline IPS, crashing it could allow subsequent malicious traffic to pass undetected. There is also a limited confidentiality impact, as the out-of-bounds read may expose one byte of adjacent heap memory. Availability is the primary concern, as the crash effectively blinds the affected network segment to threats (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability was discovered by Trail of Bits in collaboration with Anthropic and responsibly disclosed. The CVE status was listed as "Reserved" at the time of Feedly ingestion, with Nessus detection plugins (IDs 330414 and 344766) subsequently published to identify vulnerable systems. There is no current CISA KEV catalog listing for this CVE (GitHub Advisory, Tenable).

1. Reconnaissance: Identify network segments monitored by Suricata 7.0.13–7.0.16 (e.g., by observing IDS alert patterns or banner information from exposed management interfaces).
2. Craft malicious SMTP traffic: Construct an SMTP message containing a MIME body encoded in quoted-printable format, where a quoted-printable escape sequence (e.g., =XX) is deliberately split across two TCP segments or reassembly chunks.
3. Ensure the second chunk is exactly one byte: The triggering condition requires the chunk following the split escape sequence to be only one byte long, causing the decoder to read one byte beyond the heap buffer boundary.
4. Transmit the crafted traffic: Send the malformed SMTP session through the network segment monitored by the vulnerable Suricata instance.
5. Achieve denial of service: The out-of-bounds read triggers a crash of the Suricata process, disabling IDS/IPS inspection on the affected segment (GitHub Advisory).

• Process: Unexpected termination or crash of the suricata process; core dump files generated in the Suricata working directory.
• Logs: Suricata error logs (/var/log/suricata/suricata.log) showing segmentation faults or memory access errors related to MIME/SMTP processing; entries referencing the quoted-printable decoder.
• Network: Unusual SMTP sessions with MIME bodies where quoted-printable escape sequences are split across very small TCP segments (particularly a one-byte second segment); repeated SMTP connections from the same source triggering Suricata restarts.
• File System: Presence of core dump files (e.g., core.*) in the Suricata run directory following unexpected process termination (GitHub Advisory).

Upgrade Suricata to version 7.0.17 or later, which contains the patch for this vulnerability. As an immediate workaround without upgrading, set app-layer.protocols.smtp.mime.decode-quoted-printable: no in suricata.yaml to disable the vulnerable decoder. Organizations running Suricata 7.0.13 through 7.0.16 in IPS (inline) mode should prioritize patching, as a crash in this mode removes active traffic blocking (GitHub Advisory, Suricata Release).

The vulnerability was credited to Trail of Bits in collaboration with Anthropic, reflecting the growing use of AI-assisted security research. The Suricata project released versions 7.0.17 and 8.0.6 simultaneously to address multiple security issues. openSUSE and SUSE issued security announcements for their Suricata packages, and Tenable published Nessus detection plugins shortly after disclosure (openSUSE Advisory, Suricata Release, Tenable).