CVE-2026-57225 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

What is CVE-2026-57225?

CVE-2026-57225 is a low-severity vulnerability in Oisf Suricata, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

Weakness: CWE-476

Which versions are affected by CVE-2026-57225?

It affects 1 product.

Products include Oisf Suricata.

How do I fix CVE-2026-57225?

Upgrade to a fixed version.

Is CVE-2026-57225 being exploited?

There is no known exploitation of CVE-2026-57225 in the wild and no public exploit code.

Other vulnerabilities in Oisf Suricata

• CVE-2023-35853 Code injection in n/a Critical 9.8
• CVE-2021-37592 Other in n/a Critical 9.8
• CVE-2018-10244 Integer overflow in n/a Critical 9.8
• CVE-2026-94083 Memory corruption in Suricata Critical 9.4
• CVE-2026-94084 Use after free in Suricata Critical 9.4

All Oisf Suricata vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-57225, GHSA-vqqx-88xw-qqvc, UBUNTU-CVE-2026-57225.