CVE-2026-45768

Suricata versions 8.0.0 through before 8.0.5 can store an unbounded number of responses in LDAP transaction state, so crafted LDAP traffic, which can be delivered over UDP, drives excessive memory consumption in the engine and can cause a denial of service. A remote, unauthenticated attacker who can send traffic across a monitored link can trigger the condition; the impact is limited to sensor availability, with no confidentiality or integrity impact (CVSS 3.1: 7.5 High, availability only; CWE-400/CWE-770 uncontrolled resource consumption). Only deployments running Suricata 8.0.0 or later are affected, with the flaw fixed in 8.0.5, and sensors that do not inspect LDAP application-layer traffic are largely unaffected in practice. No public proof of concept or in-the-wild exploitation is known, and the issue is not in CISA's Known Exploited Vulnerabilities catalog. Defenders running the affected range should upgrade to 8.0.5 or apply the documented workarounds.

What to do: Upgrade Suricata to version 8.0.5. Where upgrading is not immediately possible, disable LDAP application-layer parsing on sensors that do not need it, or add a bypass rule that bypasses LDAP transactions carrying more than 1024 responses. Check whether monitored links carry LDAP traffic, particularly LDAP over UDP, since exposure requires that traffic.