CVE-2026-71855 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
Attackers can bypass Suricata detection by causing IPv4/IPv6 flow hash collisions, leading to incorrect flow state reuse and missed threats.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71855?
CVE-2026-71855 is a medium-severity vulnerability in Oisf Suricata, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Weakness: CWE-697
Which versions are affected by CVE-2026-71855?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2026-71855?
Upgrade to a fixed version.
Is CVE-2026-71855 being exploited?
There is no known exploitation of CVE-2026-71855 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2026-71855, GHSA-fvwh-wjcq-2586, UBUNTU-CVE-2026-71855.