{"id":"DEBIAN-CVE-2026-57226","details":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.","modified":"2026-09-29T09:00:20.754128457Z","published":"2026-09-18T20:17:17.947Z","upstream":["CVE-2026-57226"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-57226"}],"affected":[{"package":{"name":"suricata","ecosystem":"Debian:13","purl":"pkg:deb/debian/suricata?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10-1","1:7.0.10-1+deb13u1","1:7.0.10-1+deb13u2","1:7.0.10-1+deb13u3","1:7.0.10-1+deb13u4","1:7.0.11-1","1:7.0.11-1~bpo13+1","1:8.0.0-1~exp1","1:8.0.0-1~exp2","1:8.0.0-1~exp4","1:8.0.0-1~exp5","1:8.0.1-1","1:8.0.1-2","1:8.0.1-3","1:8.0.1-3~bpo13+1","1:8.0.2-1","1:8.0.2-1~bpo13+1","1:8.0.3-1","1:8.0.3-1~bpo13+1","1:8.0.3-2~exp1","1:8.0.4-1","1:8.0.4-1~bpo13+1","1:8.0.5-1","1:8.0.5-1~bpo13+1","1:8.0.6-1","1:8.0.6-1~bpo13+1","1:8.0.7-1","1:8.0.7-1~bpo13+1","1:8.0.7-2~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-57226.json"}},{"package":{"name":"suricata","ecosystem":"Debian:14","purl":"pkg:deb/debian/suricata?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0.6-1"}]}],"versions":["1:7.0.10-1","1:7.0.11-1","1:7.0.11-1~bpo13+1","1:8.0.0-1~exp1","1:8.0.0-1~exp2","1:8.0.0-1~exp4","1:8.0.0-1~exp5","1:8.0.1-1","1:8.0.1-2","1:8.0.1-3","1:8.0.1-3~bpo13+1","1:8.0.2-1","1:8.0.2-1~bpo13+1","1:8.0.3-1","1:8.0.3-1~bpo13+1","1:8.0.3-2~exp1","1:8.0.4-1","1:8.0.4-1~bpo13+1","1:8.0.5-1","1:8.0.5-1~bpo13+1","1:8.0.6-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-57226.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}