CVE-2026-22262

Description

A flaw was found in Suricata, a network intrusion detection/prevention system (IDS/IPS). When saving a dataset, the system uses a stack buffer to process the data. If an attacker provides excessively large data within a dataset, it can cause a stack overflow. This vulnerability could lead to a denial of service, making the system unavailable.

Statement

The vulnerability in Suricata, rated as MODERATE, involves a stack overflow when saving a dataset if the data exceeds the allocated buffer size. This flaw affects Suricata versions prior to 8.0.3 and 7.0.14. Red Hat customers running affected versions of Suricata are impacted if their intrusion detection rules utilize the save or state options with datasets, which can lead to a denial of service.

Mitigation

To mitigate this issue, avoid using rules with the `save` or `state` options for datasets in Suricata configurations. Disabling these specific dataset options prevents the vulnerable code path from being exercised, thereby eliminating the risk of a stack overflow. A restart of the Suricata service may be required for the changes to take effect.

Understanding the Weakness (CWE)

CWE-121

Availability

Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.

Integrity,Confidentiality,Availability,Access Control

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands; Bypass Protection Mechanism

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.

Integrity,Confidentiality,Availability,Access Control,Other

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other

When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.