CVE-2026-45765

Suricata versions prior to 7.0.16 and 8.0.5 contain a resource-exhaustion flaw (CWE-400/CWE-770) in which DNP3 reassembly can buffer data without sufficient parser-level bounds. A remote, unauthenticated attacker who can send crafted DNP3 traffic across a monitored network segment can cause the Suricata engine to consume excessive memory, potentially crashing or stalling the sensor and resulting in denial of service. Only deployments with the DNP3 application-layer parser enabled are affected; DNP3 is not enabled by default and is used mainly where Suricata monitors industrial control system (ICS/SCADA) traffic. There is no confidentiality or integrity impact, but availability of the IDS/IPS sensor can be lost. As of now there is no CISA KEV listing and no known public proof-of-concept or reported in-the-wild exploitation.

What to do: Upgrade Suricata to 7.0.16 on the 7.x branch or 8.0.5 on the 8.x branch (or later). If upgrading is not immediately possible, disable the DNP3 app-layer parser where it is not needed and set a finite 'stream.reassembly.depth' (a value of 0 or leaving it unset means unlimited reassembly depth). Check your Suricata app-layer configuration to confirm whether DNP3 is enabled before prioritizing this fix.