---
id: CVE-2026-45763
title: >-
  Suricata is a network Intrusion Detection System, Intrusion Prevention System
  and Network Security Monitoring engine
summary: >-
  Suricata is a network Intrusion Detection System, Intrusion Prevention System
  and Network Security Monitoring engine. Starting in version 8.0.0 and prior to
  version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory
  limit …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: OISF
product: suricata
affected:
  - 'suricata >= 8.0.0, < 8.0.5'
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:54:25.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45763'
references:
  - url: 'https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315'
    label: security-advisories@github.com
  - url: 'https://github.com/OISF/suricata/security/advisories/GHSA-9h43-frr8-xx6m'
    label: security-advisories@github.com
  - url: 'https://redmine.openinfosecfoundation.org/issues/8507'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T17:28:46.534722Z'
ingestedAt: '2026-09-14T14:01:49.955Z'
epss: 0.00622
epssPercentile: 0.47554
---

## Overview

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed `security.lua.max-bytes` without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.