CVE-2026-45765
Description
A flaw was found in Suricata. DNP3 reassembly could buffer data without sufficient parser-level bounds. A remote attacker sending crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in a denial of service.
Statement
Unbounded memory allocation during DNP3 stream reassembly in Suricata allows remote, unauthenticated attackers to send crafted DNP3 packet streams, causing excessive memory consumption and triggering a daemon crash. Default Red Hat deployments processing untrusted network streams with DNP3 inspection active expose the monitoring service to denial-of-service vectors without explicit parser depth boundaries.
Mitigation
Disable DNP3 parsing in the Suricata configuration file or configure a restricted maximum stream reassembly depth using the `stream.reassembly.depth` setting to cap memory utilization.
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
