CVE-2026-57225
Description
A flaw was found in Suricata, a network Intrusion Detection System. A NULL pointer dereference vulnerability exists when loading JSON or NDJSON datasets. This occurs because the system incorrectly assumes a configured value_key will always resolve to a string. A trusted or untrusted dataset or rule feed containing a non-string value for this key can trigger the flaw, causing Suricata to crash during startup, configuration testing, or rule reloading, leading to a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, ensure that all Suricata dataset and rule feeds are obtained from trusted sources and are validated for correct formatting. Restrict write access to the Suricata configuration files and the directories containing dataset and rule feeds to authorized administrators only. This prevents the introduction of malicious or malformed data that could trigger the NULL pointer dereference during Suricata startup or rule reload.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
