CVE-2026-45769

Suricata, an open-source network Intrusion Detection System/Intrusion Prevention System and network security monitoring engine, contains an uncontrolled resource consumption flaw (CWE-400/CWE-770) in its IKEv2 parser. When IKE application-layer parsing is active, the parser state grows without bounds while storing client transforms, so an unauthenticated attacker who can send repeated crafted UDP IKEv2 traffic toward the sensor can drive memory consumption ever higher. The impact is denial of service: excessive memory use that can crash or destabilize the Suricata process, with no confidentiality or integrity impact per the CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N, A:H). Deployments running Suricata versions prior to 7.0.16 and prior to 8.0.5 are affected, with practical exposure limited to sensors that have IKE parsing enabled and receive untrusted IKE traffic. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and fixed releases plus vendor workarounds are available.

What to do: Upgrade to Suricata 7.0.16 or 8.0.5. Where upgrading is not immediately possible, disable IKE application-layer parsing if it is not needed, or add a bypass rule to drop ike flow processing after the first packets (e.g., an alert ike rule with flow.pkts_toserver: > 256 and bypass; noalert;). Also review suricata.yaml to confirm whether the ike app-layer protocol is enabled and whether sensors process untrusted IKE traffic on UDP 500/4500.