CVE-2026-57225: Suricata: NULL deref crash via malformed dataset JSON

LOWPoC AVAILABLE

Published September 18, 2026

CISO Take

Suricata 8.0.0 through 8.0.5 crashes at startup, config test, or rule reload when a JSON/NDJSON dataset contains a non-string value for the configured value_key (CWE-476, CVSS 3.3, low). It is a local, low-privilege availability issue: the attacker must be able to supply or alter dataset or rule feed content, and there is no confidentiality or integrity impact. Exploitation likelihood is low in absolute terms (EPSS 0.00167), the CVE is not in CISA KEV, CISA SSVC says TRACK, and a PoC exists. The CVE is only loosely tied to AI/ML. Suricata is a network IDS/IPS that may monitor AI infrastructure, so the real risk is a monitoring blind spot if a poisoned feed crashes the sensor during a reload. Upgrade to Suricata 8.0.6, validate third-party dataset and rule feeds before deployment, and run a config test in staging before production reloads.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Low overall. Attack vector is local, privileges required are low, and impact is limited to availability of the Suricata process. The practical exposure is automated feed ingestion: if rule or dataset feeds come from external sources or are writable by many users, a crash on reload can silently disable network monitoring. No evidence of in-the-wild exploitation, and not in KEV.

How does the attack unfold?

Initial Access

Attacker gains local low-privilege access or tampers with an automated dataset or rule feed used by Suricata.

Exploitation

A JSON/NDJSON dataset entry supplies a non-string value for the configured value_key.

Impact

Suricata dereferences NULL on startup, config test, or reload and crashes, taking network monitoring offline.

AML.T0029

Initial Access

Attacker gains local low-privilege access or tampers with an automated dataset or rule feed used by Suricata.

Exploitation

A JSON/NDJSON dataset entry supplies a non-string value for the configured value_key.

Impact

Suricata dereferences NULL on startup, config test, or reload and crashes, taking network monitoring offline.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
suricata	—	—	No patch

Do you use suricata? You're affected.

How severe is it?

CVSS 3.1

3.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

Upgrade to Suricata 8.0.6 or later. Until patched, restrict write access to dataset and rule feed files and directories. Validate that every dataset entry has a string value for the configured value_key before deployment. Run suricata -T (config test) in staging against new feeds before reloading in production. Use a supervisor or watchdog to restart Suricata and alert on unexpected exits or failed reloads. Monitor for sensor downtime and gaps in event logs.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2026-57225?

Is CVE-2026-57225 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57225, increasing the risk of exploitation.

How to fix CVE-2026-57225?

Upgrade to Suricata 8.0.6 or later. Until patched, restrict write access to dataset and rule feed files and directories. Validate that every dataset entry has a string value for the configured value_key before deployment. Run suricata -T (config test) in staging against new feeds before reloading in production. Use a supervisor or watchdog to restart Suricata and alert on unexpected exits or failed reloads. Monitor for sensor downtime and gaps in event logs.

What systems are affected by CVE-2026-57225?

This vulnerability affects the following AI/ML architecture patterns: network security monitoring, IDS/IPS for ML infrastructure, security data pipelines.

What is the CVSS score for CVE-2026-57225?

CVE-2026-57225 has a CVSS v3.1 base score of 3.3 (LOW). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

network security monitoringIDS/IPS for ML infrastructuresecurity data pipelines

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

Exploitation Scenario

An adversary with low-privilege local access, or one who compromises an automated rule/dataset feed pipeline, inserts a JSON dataset entry where the configured value_key holds a number, object, or null instead of a string. When Suricata starts, runs a config test, or reloads rules, it dereferences a NULL pointer and crashes. The IDS covering an ML training or inference network goes offline, which could create a window to carry out other activity unobserved.

Weaknesses (CWE)

CWE-476NULL Pointer Dereference

CWE-476 — NULL Pointer Dereference: The product dereferences a pointer that it expects to be valid but is NULL.

[Implementation] For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
[Requirements] Select a programming language that is not susceptible to these issues.

Source: MITRE CWE corpus.