CVE-2026-22258: 
Suricata vulnerability analysis and mitigation

CVE-2026-22258 is an unbounded buffer expansion vulnerability in Suricata's DCERPC parser that allows unauthenticated remote attackers to cause memory exhaustion and crash the Suricata process. Crafted DCERPC traffic can bypass internal parser conditions to trigger indefinite buffering in the stub_data array, leading to denial of service. The vulnerability affects Suricata versions prior to 7.0.14 and versions 8.0.0 through 8.0.2. It was published on January 27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The DCERPC parsers in Suricata — covering UDP, TCP, and SMB transports — lacked any upper bound when extending the stub_data buffer; crafted fragmented DCERPC packets could bypass internal parser conditions and cause the stub_data_buffer (or stub_data_buffer_ts/stub_data_buffer_tc) to grow indefinitely via repeated extend_from_slice calls. The fix introduces a configurable DCERPC_MAX_STUB_SIZE static (defaulting to 1 MiB) and enforces it in evaluate_stub_params and the UDP/SMB parsers. While initially reported for DCERPC over UDP, DCERPC over TCP and SMB are also believed to be affected; DCERPC/TCP under default configuration is partially protected by the existing 1 MiB stream.reassembly.depth limit (GitHub Advisory, Patch Commit).

Successful exploitation causes Suricata to exhaust available memory and be killed by the operating system, resulting in a complete loss of network IDS/IPS and NSM inspection capability for the duration of the outage. There is no confidentiality or integrity impact — only availability is affected. In IPS deployments, a crash may allow malicious traffic to pass uninspected, effectively blinding the security monitoring layer (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it straightforward to trigger if a PoC were developed. The EPSS score is approximately 0.042% (0.000420), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by Xiangwei Zhang of Tencent Security YUNDING LAB (GitHub Advisory).

1. Reconnaissance: Identify network segments monitored by Suricata instances running versions prior to 7.0.14 or 8.0.0–8.0.2, particularly those with DCERPC/UDP parsing enabled.
2. Craft malicious DCERPC traffic: Construct fragmented DCERPC packets (e.g., over UDP port 135 or other DCERPC endpoints) that are designed to bypass internal parser fragment-completion conditions, keeping the transaction open while continuously appending stub data.
3. Send traffic to the monitored network: Transmit the crafted DCERPC fragments across the network segment being inspected by the vulnerable Suricata instance. No direct access to the Suricata host is required — traffic only needs to pass through or be mirrored to the sensor.
4. Trigger unbounded buffer growth: Each fragment causes Suricata's stub_data_buffer to grow without limit via repeated extend_from_slice calls, consuming system memory progressively.
5. Achieve denial of service: Once memory is exhausted, the OS kills the Suricata process, disabling all IDS/IPS inspection on that sensor (GitHub Advisory, Patch Commit).

• Network: Unusual high-volume or sustained streams of fragmented DCERPC packets (especially over UDP/135 or SMB/445) with no final fragment flag set, potentially from unexpected source IPs.
• Process: Suricata process (suricata) consuming abnormally high and continuously growing memory (observable via top, htop, or system monitoring tools) before being terminated by the OOM killer.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) showing OOM killer entries referencing the suricata process; Suricata logs showing unexpected process restarts or crash reports.
• File System: Core dump files generated by Suricata in the configured core dump directory following an unexpected crash.

Upgrade to Suricata version 7.0.14 or 8.0.3, which introduce a configurable max-stub-size limit (defaulting to 1 MiB) for DCERPC stub data buffers. If immediate upgrade is not possible, apply the following workarounds in suricata.yaml: for DCERPC/UDP, disable the parser entirely (app-layer.protocols.dcerpc.udp.enabled: no); for DCERPC/TCP, ensure stream.reassembly.depth is set to a finite value (the default 1 MiB provides protection); for DCERPC/SMB, set app-layer.protocols.smb.dcerpc.max-stub-size to a reasonable limit, noting that this may reduce SMB visibility. Upgrading to a patched version is strongly preferred over workarounds (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by Xiangwei Zhang of Tencent Security YUNDING LAB and disclosed via the OISF GitHub security advisory on January 27, 2026 (GitHub Advisory). Red Hat tracked the issue as high severity in their Bugzilla system (Red Hat Bugzilla). Debian issued a security update referencing this CVE in March 2026. Social media coverage was limited, with brief mentions on Bluesky from security news aggregators. No significant controversy or extended community debate was observed.