CVE-2026-22264 Suricata detect/alert: heap-use-after-free on alert queue expansion
An attacker can trigger a heap use-after-free via excessive alerts, potentially causing denial of service or code execution in Suricata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22264?
CVE-2026-22264 is a high-severity use after free vulnerability in Oisf Suricata, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.
Weakness: CWE-416
Which versions are affected by CVE-2026-22264?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2026-22264?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-22264 being exploited?
There is no known exploitation of CVE-2026-22264 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2026-22264, GHSA-mqr8-m3m4-2hw5, UBUNTU-CVE-2026-22264.