---
id: CVE-2026-45752
title: 'Suricata detect/transform: use-after-free in decompress transforms'
summary: >-
  Suricata is a network Intrusion Detection System, Intrusion Prevention System
  and Network Security Monitoring engine. Starting in version 8.0.0 and prior to
  version 8.0.5, when certain detection transforms are chained, the decompress
  tra…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: OISF
product: suricata
affected:
  - 'suricata >= 8.0.0, < 8.0.5'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T17:44:38.906745Z'
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:46:04.554Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45752'
references:
  - url: 'https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3'
    label: 'https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3'
  - url: 'https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315'
    label: 'https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315'
  - url: 'https://redmine.openinfosecfoundation.org/issues/8536'
    label: 'https://redmine.openinfosecfoundation.org/issues/8536'
tags:
  - cve.org
epss: 0.00509
epssPercentile: 0.42452
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.

## Affected

- `suricata >= 8.0.0, < 8.0.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.