CVE-2026-45747
largeNULL Pointer Dereference DoS in Suricata Lua TLS Certificate Helper
Suricata versions prior to 7.0.16 contain a NULL pointer dereference (CWE-476) in the Lua TLS certificate information helper, which is reached when a Lua script calls the TlsGetCertInfo function on TLS traffic whose certificate is missing certain fields. A remote attacker can trigger the flaw by sending crafted TLS traffic with absent certificate fields through a network segment monitored by an affected sensor, causing the Suricata engine to crash. The impact is denial of service of network intrusion detection/prevention monitoring (CVSS 3.1 7.5, availability-only impact); there is no confidentiality or integrity impact. Only deployments of Suricata before 7.0.16 that actually run Lua TLS scripts requesting certificate information are affected; sites using default rulesets without such Lua scripting are not exposed. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and version 7.0.16 contains the fix.
What to do: Upgrade Suricata to version 7.0.16 or later. As an interim mitigation, avoid Lua scripts that call TlsGetCertInfo on untrusted traffic, or update those scripts to tolerate missing certificate fields; audit custom/local Lua rulesets to confirm whether TlsGetCertInfo is used.
| OISF (Open Information Security Foundation) Suricata | Prior to 7.0.16; practically limited to deployments using Lua TLS scripting that calls the TlsGetCertInfo helper on untrusted traffic |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.
- Weakness
- CWE-476
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.