CVE-2026-31931: 
Suricata vulnerability analysis and mitigation

CVE-2026-31931 is a NULL pointer dereference vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine. When the tls.alpn rule keyword is used in detection rules, Suricata can crash due to improper handling of a NULL pointer, resulting in a denial of service. The vulnerability affects Suricata versions 8.0.0 through 8.0.3 and was patched in version 8.0.4, released on March 17, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in Suricata's handling of the tls.alpn rule keyword, which is used to match the TLS Application-Layer Protocol Negotiation extension in network traffic. When a rule using this keyword is evaluated against certain network traffic, Suricata dereferences a pointer that is unexpectedly NULL, causing an application crash. The vulnerability is remotely exploitable with no authentication, privileges, or user interaction required — an attacker simply needs to send crafted or opportunistic network traffic that triggers evaluation of a tls.alpn-based rule. The issue was discovered by OSS-Fuzz (GitHub Advisory).

Successful exploitation causes Suricata to crash, resulting in a complete loss of availability for the IDS/IPS/NSM monitoring function. This means network traffic is no longer inspected or blocked during the outage, potentially leaving the protected network exposed to other threats. There is no impact on confidentiality or data integrity, as the vulnerability only affects availability (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the target Suricata instance has at least one active rule using the tls.alpn keyword; notably, no common rulesets are known to use this keyword by default (GitHub Advisory).

1. Reconnaissance: Identify network segments monitored by Suricata 8.0.0–8.0.3 instances that have rules using the tls.alpn keyword active.
2. Craft TLS traffic: Generate TLS ClientHello or ServerHello packets containing an ALPN extension with values designed to trigger the NULL dereference condition during rule evaluation.
3. Transmit traffic: Send the crafted TLS packets across the monitored network segment so they are captured and processed by the vulnerable Suricata instance.
4. Trigger crash: Suricata evaluates the tls.alpn rule against the packet, dereferences a NULL pointer, and crashes — disabling IDS/IPS/NSM monitoring for the duration of the outage (GitHub Advisory).

• Logs: Suricata process crash logs or core dump files generated around the time of suspicious TLS traffic; system logs (e.g., syslog, journald) showing unexpected Suricata process termination.
• Process: Suricata process absent or repeatedly restarting (if supervised by systemd or similar); watchdog or monitoring alerts for Suricata service unavailability.
• Network: Unusual or malformed TLS ClientHello/ServerHello packets with ALPN extensions targeting monitored interfaces, particularly from external or untrusted sources.

Upgrade Suricata to version 8.0.4 or later, which contains the official patch for this vulnerability (GitHub Advisory, Suricata Release). As a temporary workaround for organizations unable to upgrade immediately, disable or remove any IDS/IPS rules that use the tls.alpn keyword. The advisory notes that no common rulesets (e.g., Emerging Threats, Suricata default rules) use this keyword, so the workaround impact should be minimal for most deployments (GitHub Advisory).

The vulnerability was discovered by OSS-Fuzz, Google's continuous fuzzing service for open-source software, and responsibly disclosed to the OISF team. The Suricata project published the advisory and patched release promptly. Coverage appeared on security aggregators and community forums, including the Suricata community forum and openSUSE security announcements, but no significant controversy or widespread concern was noted given the limited real-world rule usage of the affected keyword (Suricata Forum, openSUSE).