CVE-2026-45763: 
Suricata vulnerability analysis and mitigation

CVE-2026-45763 is a Lua sandbox memory limit bypass vulnerability in Suricata, an open-source network IDS/IPS/NSM engine developed by OISF. When Lua rule execution is enabled, the Lua sandbox memory limit (security.lua.max-bytes) is not consistently enforced for new allocations, allowing certain Lua allocation patterns to exceed the configured limit without triggering the intended restriction. This affects Suricata versions 8.0.0 through 8.0.4; version 8.0.5 contains the fix. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the Lua sandbox allocator does not uniformly apply the configured security.lua.max-bytes ceiling to all new memory allocation paths, leaving certain allocation patterns unchecked. An unauthenticated remote attacker can craft network traffic that triggers an affected Lua rule or script loaded by Suricata, causing unbounded memory consumption within the Lua VM. Exploitation requires two preconditions: Lua rules must be enabled (security.lua.allow-rules = true) and a vulnerable Lua script/rule must be actively loaded by the engine. No public proof-of-concept code has been identified at this time (GitHub Advisory).

Successful exploitation results in an availability impact only — there is no confidentiality or integrity loss. An attacker sending specially crafted network traffic can cause the Suricata process to consume excessive memory beyond the intended sandbox limit, potentially leading to resource exhaustion, process instability, or denial of service of the IDS/IPS/NSM engine. Loss of Suricata availability could blind network defenders to ongoing attacks, indirectly increasing organizational risk (GitHub Advisory).

There is no known in-the-wild exploitation of CVE-2026-45763, and no public proof-of-concept exploit code has been identified. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity and the requirement for specific Lua rule configurations to be present. The EPSS score is approximately 0.086%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

Upgrade Suricata to version 8.0.5, which contains the official fix for this vulnerability. For organizations unable to upgrade immediately, the recommended workaround is to disable security.lua.allow-rules in the Suricata configuration unless Lua rules are strictly required for detection use cases. Disabling Lua rules eliminates the attack surface entirely until patching can be completed (GitHub Advisory, Suricata Release).

The vulnerability was credited to researcher Sreejith Gopinath and disclosed via GitHub Security Advisories by OISF maintainer jasonish on June 2, 2026. Community discussion has been limited, with the issue tracked in the OISF Redmine issue tracker. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory).