CVE-2026-45752

Name	CVE-2026-45752
Description	Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
suricata (PTS)	trixie	1:7.0.10-1+deb13u4	vulnerable
	forky, sid	1:8.0.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
suricata	source	(unstable)	1:8.0.5-1

Notes

https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3
https://redmine.openinfosecfoundation.org/issues/8541 (suricata-8.0.5)
https://github.com/OISF/suricata/commit/11d1fe1ca866d82e8bb3dd4493016188d890aebd (suricata-8.0.5)