CVE-2026-45770

Suricata versions 8.0.0 through before 8.0.5 contain a flaw (CWE-693 protection mechanism failure, CWE-787 out-of-bounds write) in which a Lua detection rule that registers too many flow variables corrupts Lua detection state and can allow bypass of Suricata's restricted Lua sandbox. The condition only arises when an affected Lua script/rule is loaded, and the excessive flow-variable registration — potentially driven by traffic matching such rules — can also crash the Suricata engine. An attacker who triggers the condition gains a bypass of the Lua sandbox's restrictions, scored as a high integrity impact (no confidentiality impact per the CVSS vector), with crash-related availability risk as a secondary effect. Only deployments running Suricata 8.0.0–8.0.4 with Lua rules enabled are affected; users of other versions or without Lua rules are not exposed. There is currently no known exploitation, no public proof-of-concept, and the issue is not listed in CISA KEV; the fix is available in Suricata 8.0.5.

What to do: Upgrade Suricata to version 8.0.5, which contains the fix. Where upgrading is not immediately possible, disable 'security.lua.allow-rules' unless Lua rules are required, and audit any loaded Lua rules for excessive flow-variable registration while monitoring for crashes or unexpected Lua state behavior.