{"id":"CVE-2026-57228","title":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine","summary":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a hea…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"OISF","product":"suricata","affected":["suricata >= 7.0.13, < 7.0.17"],"published":"2026-09-18","updated":"2026-09-21","sourceUpdated":"2026-09-21T21:17:05.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57228","references":[{"url":"https://github.com/OISF/suricata/commit/19880f9d5bbe2b8f8e8867a577848dce2b532c86","label":"security-advisories@github.com"},{"url":"https://github.com/OISF/suricata/releases/tag/suricata-7.0.17","label":"security-advisories@github.com"},{"url":"https://github.com/OISF/suricata/security/advisories/GHSA-qxm4-q7vx-7xj4","label":"security-advisories@github.com"},{"url":"https://redmine.openinfosecfoundation.org/issues/8608","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-21T19:48:41.391355Z"},"epss":0.00562,"epssPercentile":0.45319,"ingestedAt":"2026-09-18T20:51:25.801Z","slug":"CVE-2026-57228","body":"## Overview\n\nSuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}