CVE-2026-63446

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

• CWE-401
• CWE-407

• https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8
• https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7
• https://github.com/OISF/suricata/pull/15726
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
• https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m
• https://redmine.openinfosecfoundation.org/issues/8628

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …5.9
• CVE-2026-63449Suricata is a network Intrusion Detection System, Intrusion …3.7
• CVE-2026-6345Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63450Suricata is a network Intrusion Detection System, Intrusion …3.7
• CVE-2026-63451Suricata is a network Intrusion Detection System, Intrusion …3.3