CVE-2026-57224 Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
Attackers can cause resource exhaustion and denial of service in Suricata by sending unidirectional traffic that triggers unbounded transaction growth in DHCP and RDP parsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57224?
CVE-2026-57224 is a medium-severity denial of service vulnerability in Oisf Suricata, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
Which versions are affected by CVE-2026-57224?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2026-57224?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-57224 being exploited?
There is no known exploitation of CVE-2026-57224 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2026-57224, GHSA-m2vc-g65c-ph7m, UBUNTU-CVE-2026-57224.