CVE-2026-71855 | BDVDB-2026-376757 Detail
OISFsuricata
Description#
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-697 Incorrect Comparison
References#
- https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586
- https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f
- https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701
- https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20
- https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
- https://redmine.openinfosecfoundation.org/issues/8558
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.