CVE-2026-57227
highSuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.
Vendor / product: Oisf — suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-18 21:17
Modified: 2026-09-29 12:48
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:54 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
oisf / suricata ≥7.0.0 <7.0.17, ≥8.0.0 <8.0.6
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/OISF/suricata/commit/03ba8a71d827dd36a0ceb512f45d2f440f260a3a
Patch / mitigation: https://github.com/OISF/suricata/commit/5cde93dea38533c9b225128ba9d54955997dc273
Patch / mitigation: https://github.com/OISF/suricata/commit/c03666d261256df5a2d1f5800872da8a5addf6a5
Patch / mitigation: https://github.com/OISF/suricata/security/advisories/GHSA-7h2h-hpj2-9w6p
References
- https://github.com/OISF/suricata/commit/03ba8a71d827dd36a0ceb512f45d2f440f260a3a security-advisories@github.com
- https://github.com/OISF/suricata/commit/5cde93dea38533c9b225128ba9d54955997dc273 security-advisories@github.com
- https://github.com/OISF/suricata/commit/c03666d261256df5a2d1f5800872da8a5addf6a5 security-advisories@github.com
- https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 security-advisories@github.com
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 security-advisories@github.com
- https://github.com/OISF/suricata/security/advisories/GHSA-7h2h-hpj2-9w6p security-advisories@github.com
- https://redmine.openinfosecfoundation.org/issues/8525 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:54 UTC · record ↗