CVE-2026-63446

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

• CWE-401
• CWE-407

• https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8Patch
• https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7Patch
• https://github.com/OISF/suricata/pull/15726Patch
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6Release Notes
• https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877mMitigation, Vendor Advisory
• https://redmine.openinfosecfoundation.org/issues/8628Permissions Required

Published

Sep 18, 2026

Last Modified

Sep 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-634402FAuth is a web app to manage Two-Factor Authentication (2FA…5.9
• CVE-2026-634412FAuth is a web app to manage Two-Factor Authentication (2FA…4.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63449Suricata is a network Intrusion Detection System, Intrusion …5.3
• CVE-2026-6345Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63450Suricata is a network Intrusion Detection System, Intrusion …5.3
• CVE-2026-63451Suricata is a network Intrusion Detection System, Intrusion …5.5