CVE-2026-31931

Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OISF/suricata/security/advisories/GHSA-gr22-4784-xvw3	Vendor Advisory
https://redmine.openinfosecfoundation.org/issues/8294	Issue Tracking Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Suricata es un motor de IDS, IPS y NSM de red. Desde la versión 8.0.0 hasta antes de la versión 8.0.4, el uso de la palabra clave de regla ’tls.alpn’ puede causar que Suricata se bloquee con una desreferencia NULL. Este problema ha sido parcheado en la versión 8.0.4.

Information

Published : 2026-04-02 14:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-31931

Mitre link : CVE-2026-31931

CVE.ORG link : CVE-2026-31931

JSON object : View

Products Affected

oisf

suricata

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-31931", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31931", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T14:18:13.377669Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": ">= 8.0.0, < 8.0.4"}]}]}], "published": "2026-04-02T14:16:28.587", "references": [{"url": "https://github.com/OISF/suricata/security/advisories/GHSA-gr22-4784-xvw3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://redmine.openinfosecfoundation.org/issues/8294", "tags": ["Issue Tracking", "Permissions Required"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the \"tls.alpn\" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4."}, {"lang": "es", "value": "Suricata es un motor de IDS, IPS y NSM de red. Desde la versi\u00f3n 8.0.0 hasta antes de la versi\u00f3n 8.0.4, el uso de la palabra clave de regla \u2019tls.alpn\u2019 puede causar que Suricata se bloquee con una desreferencia NULL. Este problema ha sido parcheado en la versi\u00f3n 8.0.4."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F35C5A48-CA30-43B3-9E53-D3E51C862604", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}