CVE-2026-57229

Overview

Suricata versions 8.0.0 through 8.0.6 contain a MIME parser flaw that fails to reset state for message/rfc822 encapsulations. This allows crafted SMTP messages to leak outer MIME encoding or filename information into inner messages, enabling attackers to bypass file‑based or URL‑based detection rules when SMTP MIME decoding is active. The issue is fixed in Suricata 8.0.6.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.

Impact

The vulnerability compromises the integrity of detection logic, allowing malicious attachments or URLs to slip past Suricata’s file and URL inspection rules. This can lead to undetected exfiltration or delivery of malicious payloads, undermining the confidentiality of monitored traffic. Defenders relying on Suricata for email traffic analysis are directly impacted.

Remediation

['Upgrade Suricata to version 8.0.6 or later to apply the patch that fully resets MIME state.', 'If an upgrade is not immediately possible, disable the SMTP MIME decoding feature in Suricata’s configuration to prevent the state leakage from affecting rule evaluation.', 'Verify that the configuration change is in effect by checking the Suricata logs for any MIME parsing errors or by running a test SMTP message through the system.', 'Maintain an inventory of Suricata versions in use and schedule timely updates as part of the patch management process.']

Risk context

The CVSS v3 score of 5.3 indicates a medium severity risk. With no EPSS data available, the urgency is moderate; defenders should prioritize patching or mitigation to prevent potential evasion of detection in email traffic.

Affected products

• Suricata 8.0.0
• Suricata 8.0.1
• Suricata 8.0.2
• Suricata 8.0.3
• Suricata 8.0.4
• Suricata 8.0.5
• Suricata 8.0.6