5.3

CVE-2026-57222

Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both, causing incorrect detection state. This issue is fixed in versions 8.0.6 and 7.0.17.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oisf ≫ Suricata Version < 7.0.17
Oisf ≫ Suricata Version >= 8.0.0 < 8.0.6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.378
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-697 Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

https://github.com/OISF/suricata/commit/4a728464e6eb9e273bb02e3df0c28929b28db71d
Patch
https://github.com/OISF/suricata/commit/9d788575c5d22a34eeed50d56557ed12b05e0aec
Patch
https://github.com/OISF/suricata/commit/c92e270c4a795c52bce610aa1ce9ebaf065c49e6
Patch
https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
Release Notes
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
Release Notes
https://github.com/OISF/suricata/security/advisories/GHSA-2r8x-23fw-hgcg
Vendor Advisory
https://redmine.openinfosecfoundation.org/issues/8559
Permissions Required