CVE-2026-22261: 
Suricata vulnerability analysis and mitigation

CVE-2026-22261 is a denial-of-service vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine, caused by inefficiencies in X-Forwarded-For (XFF) header handling within the EVE alert/HTTP1 subsystem. The flaw affects all Suricata versions prior to 7.0.14 and versions 8.0.0 through 8.0.3 (exclusive). It was published on January 27, 2026, by the OISF security team. The CVSS v3.1 base score is 5.3 (Medium) per NVD, while the GitHub Security Advisory rates it 3.7 (Low) with higher attack complexity (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1050 (Excessive Platform Resource Consumption within a Loop). Specifically, the AppLayerParserGetTxCnt function for HTTP1 transactions used a loop to iterate over all transactions in a VecDeque to find the one with the maximum index, rather than directly accessing the last element. This inefficiency is particularly severe when processing XFF headers for alerts not triggered within a transaction context. The fix replaces the iterative lookup with a direct transactions.back() call, eliminating the O(n) loop (GitHub Commit 3f0725b, GitHub Commit af246ae, GitHub Advisory).

Successful exploitation causes severe performance slowdowns in the Suricata engine, degrading its real-time traffic analysis and monitoring capabilities. The availability impact is limited (Low per CVSS), with no confidentiality or integrity impact. However, in high-traffic environments, the resource exhaustion could effectively blind network security monitoring by causing Suricata to fall behind on packet processing, reducing detection fidelity (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication or user interaction, but the attack complexity is rated High by the GitHub advisory, as triggering the worst-case behavior requires specific traffic patterns involving XFF headers and non-transaction alerts (GitHub Advisory).

Users should upgrade Suricata to version 7.0.14 or later (for the 7.0.x branch) or version 8.0.3 or later (for the 8.0.x branch), which contain the patch (GitHub Advisory). As an immediate workaround, disable XFF support in the EVE logging configuration — note that this setting is disabled by default, so deployments that have not explicitly enabled XFF are not affected. Organizations that have enabled XFF in their EVE configuration should prioritize upgrading or apply the workaround until patching is feasible (Red Hat Bugzilla).

The vulnerability was disclosed by the OISF (Open Information Security Foundation) maintainer victorjulien via a GitHub Security Advisory on January 27, 2026. Red Hat tracked the issue as a low-severity bug in their Bugzilla system. No significant broader media coverage or notable researcher commentary beyond the official advisory has been observed (GitHub Advisory, Red Hat Bugzilla).