CVE-2026-22262 is a medium severity stack overflow (CVSS 5.9) in Suricata, the network IDS and IPS engine, triggered when it saves a dataset whose data is too large. It affects versions before 7.0.14 and 8.0.3. Upgrade to a fixed release, or avoid datasets with the save or state options.
What's affected
Suricata versions before 8.0.3 on the 8.0 line and before 7.0.14 on the 7.0 line. The fixed versions are 8.0.3 and 7.0.14.
The advisory lists a workaround: do not use rules with the datasets save or state options.
How to check if you're exposed
Print the installed version:
suricata -V
Then search your rule files for dataset rules that use the save or state options.
grep -rn "dataset" /etc/suricata/rules/ | grep -E "save|state"
The path may differ on your system. Rules from outside sources are worth checking first.
What to do now
- Upgrade to Suricata 8.0.3 or 7.0.14, or newer.
- If you cannot upgrade yet, remove rules that use datasets with save or state.
- Review where your rules come from, and avoid untrusted rule sources.
- Restart the engine after upgrading and confirm the version with the command above.
- Watch for unexpected crashes of the sensor process, which can show up as gaps in monitoring.
Why it matters
The weakness is CWE-121 and CWE-787, a stack based buffer overflow that writes past the end of a fixed buffer. Per the record, a stack buffer is used to prepare dataset data for saving, and data larger than the buffer overflows it.
The score is 5.9 because attack complexity is high and the vector shows availability as the only impact. For a sensor, a crash matters in its own right, because traffic is not inspected while the engine is down.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. It is one of two Suricata issues fixed in the same releases, along with a use after free tracked as CVE-2026-22264.
Quick check
Do I need a rule with datasets for this to matter?
Per the advisory the workaround is to avoid rules with the datasets save or state options, so the flaw ties to that feature.
Which version should I move to?
8.0.3 if you run the 8.0 line, 7.0.14 if you run 7.0, or anything newer.
Sources
Last reviewed: 19 October 2026.
