Vulnerability Details CVE-2026-57225
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 1.8%
CVSS Severity
CVSS v3 Score 3.3
References
- https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5
- https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53
- https://github.com/OISF/suricata/pull/15699
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
- https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc
- https://redmine.openinfosecfoundation.org/issues/8624