CVE-2026-22262: 
Suricata vulnerability analysis and mitigation

CVE-2026-22262 is a stack-based buffer overflow vulnerability in Suricata's dataset saving functionality, classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). When saving a dataset, a fixed-size stack buffer is used to prepare data; if the dataset content is too large, the buffer overflows. It affects all Suricata versions prior to 7.0.14 and versions 8.0.0 through 8.0.2. The vulnerability was published on January 27, 2026. The GitHub Security Advisory assigns a CVSS v3.1 score of 5.9 (Medium), while NVD rates it 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is in src/datasets-string.c within the StringAsBase64 function, where a variable-length array (uint8_t encoded_data[len]) was allocated on the stack using the Base64-encoded size of the dataset string without bounds checking. If the dataset entry is sufficiently large, the computed len exceeds the stack frame, causing a stack overflow (CWE-121/CWE-787). The fix replaces the stack allocation with a bounds check against the output buffer size, and for cases where the data exceeds 1024 bytes, falls back to heap allocation via SCCalloc in src/util-thash.c. Exploitation requires that Suricata be configured with rules using the save or state dataset options, and that an attacker can influence the content of a tracked dataset (e.g., by sending specially crafted network traffic that causes a large string to be stored in the dataset) (GitHub Advisory, Patch Commit, Heap Fallback Commit).

Successful exploitation crashes the Suricata IDS/IPS/NSM engine, resulting in a complete denial of service for network monitoring and intrusion detection capabilities. With the engine offline, malicious network activity would go undetected, potentially enabling follow-on attacks. The GitHub advisory scores availability impact as High with no confidentiality or integrity impact, reflecting a DoS-focused threat; however, NVD's higher score reflects the theoretical possibility of memory corruption leading to code execution in some configurations (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.064%, indicating a low probability of exploitation in the near term. Exploitation requires that the target Suricata instance uses rules with save or state dataset options, which limits the attack surface to specific configurations.

OISF has released patched versions 7.0.14 and 8.0.3 that address this vulnerability by adding bounds checking before stack allocation and falling back to heap allocation for large datasets. Organizations should upgrade to one of these versions as the primary remediation. As an immediate workaround for those unable to patch promptly, disable or remove any Suricata rules that use the save or state options in dataset keyword configurations (GitHub Advisory, Red Hat CVE).

The vulnerability was published by OISF maintainer victorjulien via GitHub Security Advisories on January 27, 2026, and the Suricata forum announced the 8.0.3 and 7.0.14 releases addressing this and other issues. Red Hat tracked the issue and Debian also issued a security update. Community coverage has been limited to vulnerability aggregators and scanner vendors (Nessus, Qualys), with no notable independent researcher commentary or significant social media discussion observed (Suricata Forum, Red Hat CVE).