CVE-2026-45762

Suricata versions prior to 7.0.16 and 8.0.5 contain a type-confusion flaw (CWE-843) in the IP defragmentation tracker lookup: the code did not verify that an existing defragmentation tracker used the same IP address family as the packet being processed. An attacker can trigger the flaw remotely by sending crafted fragmented IPv4/IPv6 traffic in which an IPv6 fragment is associated with an IPv4 defragmentation tracker, causing Suricata to crash when it performs defragmentation. The impact is denial of service only — a remote, unauthenticated, packet-triggered crash (CVSS 3.1 7.5, high availability impact with no confidentiality or integrity impact) — potentially taking IDS/IPS sensors offline until restarted. Anyone running affected Suricata versions as an IDS, IPS, or network security monitoring engine on traffic containing fragmented packets is affected. No public proof of concept is known, the issue is not in CISA KEV, and no exploitation in the wild has been reported.

What to do: Upgrade Suricata to 7.0.16 on the 7.x branch or 8.0.5 on the 8.x branch (or later). If patching is delayed and Suricata runs as an IDS with AF_PACKET, enable AF_PACKET's 'defrag' option so packets are defragmented before Suricata sees them. Prioritize internet-facing and inline IPS sensors since the crash can be triggered by unsolicited crafted fragmented traffic, though no in-the-wild exploitation is currently known.