rootpwn

medium · CVSS v3 5.9

CVE-2026-71855

Suricata versions prior to 7.0.17 and 8.0.6 incorrectly treat IPv4 and IPv6 flows as identical, allowing an attacker to reuse flow state acr

Overview

Suricata versions prior to 7.0.17 and 8.0.6 incorrectly treat IPv4 and IPv6 flows as identical, allowing an attacker to reuse flow state across IP families. This flaw can corrupt flowbit state, bypass detection rules, or create IP‑only bypasses. The issue is fixed in newer releases.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.

Impact

Confidentiality: attackers may bypass detection rules, allowing malicious traffic to go undetected. Integrity: corrupted flowbit state can produce false positives or negatives. Availability: mismanaged flow state may lead to resource exhaustion. Defenders: network security teams deploying Suricata IDS/IPS are directly impacted.

Remediation

Upgrade Suricata to at least 7.0.17 or 8.0.6. If an upgrade is not immediately possible, isolate IPv4 and IPv6 traffic to separate Suricata instances or disable shared flowbit state. Verify that configuration files do not share flow tables across IP families and monitor logs for anomalous flowbit behavior.

Risk context

The vulnerability has a medium severity (CVSS 5.9) and no EPSS data is available. While it does not allow direct exploitation, it can lead to detection bypass, so timely patching is advised.

Affected products

  • Suricata 7.x
  • Suricata 8.x
  • Suricata 6.x
  • Suricata 5.x
  • Suricata 4.x
  • Suricata 3.x
  • Suricata 2.x
  • Suricata 1.x

Scores

Severity
medium
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
—
EPSS
—

Suricata IDS IP-family flowbit detection-bypass medium network-security

← All CVEs

Related CVEs

medium

CVE-2026-77875

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.

View analysis

medium

CVE-2026-93921

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

View analysis

medium

CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.

View analysis

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis