CVE-2026-45747 Suricata lua/tls: null dereference in TlsGetCertInfo
Attackers can crash Suricata by sending crafted TLS traffic if Lua scripts request certificate info, requiring an upgrade or script modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45747?
CVE-2026-45747 is a high-severity vulnerability in Oisf Suricata, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.
Weakness: CWE-476
Which versions are affected by CVE-2026-45747?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2026-45747?
Upgrade to a fixed version.
Is CVE-2026-45747 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45747 exists.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2026-45747, GHSA-vfc5-9844-rmhv, UBUNTU-CVE-2026-45747.