rootpwn

high · CVSS v3 8.2

CVE-2026-57228

CVE-2026-57228 affects Suricata versions 7.0.13 through 7.0.17, enabling an out-of-bounds read in the SMTP MIME quoted-printable decoder. Th

Overview

CVE-2026-57228 affects Suricata versions 7.0.13 through 7.0.17, enabling an out-of-bounds read in the SMTP MIME quoted-printable decoder. The flaw can be triggered by crafted SMTP traffic, causing Suricata to crash. This disrupts network monitoring and can expose the network to undetected threats.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.

Impact

The vulnerability can cause a denial of service by crashing Suricata, disrupting network monitoring and potentially exposing the network to undetected threats. It affects confidentiality, integrity, and availability of the IDS/IPS system. Network administrators and security teams are directly impacted.

Remediation

Upgrade Suricata to version 7.0.17 or later. If an upgrade is not immediately possible, disable MIME quoted-printable decoding in the Suricata configuration or filter SMTP traffic before it reaches Suricata.

Risk context

High severity with CVSS 8.2. No EPSS data is available. Prompt patching is recommended to avoid service disruption.

Affected products

  • Suricata

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.2
CVSS v4
—
EPSS
—

suricata smtp mime out-of-bounds denial-of-service network-ids high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-84106

IBM Guardium Data Protection 12.2 is vulnerable to remote authenticated code execution due to improper input neutralization in web page generation. Attackers who can authenticate to the Guardium web interface can run arbitrary code on the host. This flaw can compromise the confidentiality, integrity, and availability of protected data.

View analysis

high

CVE-2026-84108

IBM Guardium Data Protection 12.2 is vulnerable to remote code execution due to improper input neutralization during web page generation. Attackers can exploit this flaw to run arbitrary code on the affected system. The vulnerability poses a significant risk to data protection environments.

View analysis