CVE-2026-57228
Description
A flaw was found in Suricata. A heap out-of-bounds read vulnerability exists in the SMTP MIME quoted-printable decoder. A remote attacker can send specially crafted SMTP traffic, causing a quoted-printable escape sequence to be split across traffic chunks. This can lead to a one-byte read past a heap buffer, resulting in a denial of service by crashing the Suricata engine.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can crash the Suricata process via malformed network traffic, causing a complete denial of service for intrusion detection and prevention monitoring. Suricata is not shipped as part of core Red Hat Enterprise Linux repositories and is only available through Extra Packages for Enterprise Linux (EPEL). In addition, exploitation requires the optional MIME quoted-printable decoding feature to be active within the SMTP inspection configuration.
Mitigation
To mitigate this issue, disable the `decode-quoted-printable` MIME decoding feature in Suricata's configuration if it is not required for your environment. This can typically be done by modifying the Suricata configuration file (e.g., `suricata.yaml`) to disable or remove the relevant `decode-quoted-printable` setting under the SMTP protocol configuration. Disabling this feature may affect Suricata's ability to inspect quoted-printable encoded content within SMTP traffic. A restart of the Suricata service is required for the changes to take effect.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
