CVE-2026-22259: 
Suricata vulnerability analysis and mitigation

CVE-2026-22259 is a denial-of-service vulnerability in Suricata's DNP3 protocol parser that allows unauthenticated remote attackers to cause excessive memory consumption, potentially crashing the process. The root cause is unbounded transaction growth during DNP3 traffic parsing, classified as uncontrolled resource consumption. It affects all Suricata versions prior to 7.0.14 and versions 8.0.0 through 8.0.2 (prior to 8.0.3). The vulnerability was disclosed on January 27, 2026, and reported by Xiangwei Zhang of Tencent Security YUNDING LAB. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The root cause lies in the DNP3GetAlstateProgress function in src/app-layer-dnp3.c, where the code incorrectly checked the complete flag instead of the done flag to determine transaction progress. Because some DNP3 messages with unknown objects are never marked complete even though they are fully processed, transactions accumulate without bound, causing unbounded memory growth. The fix is a single-line change replacing dnp3tx->complete with dnp3tx->done in the alstate-progress callback (GitHub Commit 1, GitHub Commit 2).

Successful exploitation causes Suricata to consume progressively larger amounts of memory while processing specially crafted DNP3 traffic, leading to process slowdown and eventual termination by the Linux OOM killer. The impact is limited to availability — there is no confidentiality or integrity impact. In environments where Suricata is deployed as an IPS (inline mode), its termination would result in a loss of network security monitoring and intrusion prevention capabilities, potentially allowing other malicious traffic to pass undetected (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The vulnerability is remotely exploitable with no authentication or user interaction required, making it accessible to any attacker who can send DNP3 traffic to a monitored network segment. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection is available via Nessus (plugin 298995) and Qualys (detection ID 6274867) (GitHub Advisory, Feedly).

1. Identify target: Determine if the target network uses Suricata (versions < 7.0.14 or 8.0.0–8.0.2) with the DNP3 parser enabled (note: DNP3 is disabled by default, so this requires a non-default configuration).
2. Craft malicious DNP3 traffic: Generate DNP3 packets containing object types unknown to Suricata's parser, so that parsed messages are never marked complete but remain in an open transaction state.
3. Transmit traffic to monitored segment: Send a continuous stream of these crafted DNP3 packets across the network segment monitored by the vulnerable Suricata instance, targeting the default DNP3 port (TCP/UDP 20000).
4. Trigger memory exhaustion: As Suricata processes each packet, new transactions accumulate without being freed due to the incorrect complete flag check, causing memory usage to grow unboundedly.
5. Achieve denial of service: Suricata's process slows and eventually exhausts available memory, causing it to be killed by the OOM killer, disabling IDS/IPS functionality (GitHub Advisory, GitHub Commit 1).

• Process Behavior: Suricata process (suricata) exhibiting continuously increasing memory consumption over time as observed via top, htop, or /proc/<pid>/status; process termination with OOM killer log entries.
• Logs: Linux kernel OOM killer messages in /var/log/syslog or dmesg referencing the Suricata process (e.g., Out of memory: Kill process <pid> (suricata)); Suricata logs showing high transaction counts for DNP3 application layer state.
• Network: Unusual volume of DNP3 traffic (TCP/UDP port 20000) from unexpected sources on monitored network segments; repeated DNP3 packets containing unknown object types.

Upgrade Suricata to version 7.0.14 or 8.0.3, which contain the patch correcting the DNP3 alstate-progress callback logic. As an immediate workaround for systems that cannot be upgraded, disable the DNP3 parser in the suricata.yaml configuration file — notably, the DNP3 parser is disabled by default, so only deployments that have explicitly enabled it are affected. Organizations should verify their Suricata configuration and prioritize upgrading if DNP3 parsing is required (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by Xiangwei Zhang of Tencent Security YUNDING LAB and disclosed by the OISF maintainer victorjulien via GitHub Security Advisories on January 27, 2026. Debian issued a security update referencing this CVE in March 2026, and Tenable published detection plugins (Nessus 298995) shortly after disclosure. Community discussion was noted on the Suricata forum following the 8.0.3 and 7.0.14 release announcement (GitHub Advisory, Debian News).