CVE-2026-22264 is a high severity heap use after free (CVSS 7.4) in Suricata, the network IDS and IPS engine. An unsigned integer overflow occurs when a single packet generates an excessive number of alerts. It affects versions before 7.0.14 and 8.0.3. Upgrade to a fixed release.
What's affected
Suricata versions before 8.0.3 on the 8.0 line and before 7.0.14 on the 7.0 line. The fixed versions are 8.0.3 and 7.0.14.
The advisory lists workarounds: do not run untrusted rulesets, and do not run with 65536 or more signatures that can match on the same packet.
How to check if you're exposed
Print the installed version:
suricata -V
Then look at where your rules come from and how many are enabled.
ls -l /var/lib/suricata/rules/
The path varies by install. A very large ruleset from several untrusted feeds is the case the advisory warns about.
What to do now
- Upgrade to Suricata 8.0.3 or 7.0.14, or newer.
- Review every rule source and drop feeds you do not trust.
- Keep the number of signatures that can match the same packet under 65536, as the advisory describes.
- Restart the engine and confirm the version after the upgrade.
- Alert on sensor crashes and restarts so a gap in coverage is noticed.
Why it matters
The weakness is CWE-416, a use after free. Memory is released and then used again, which can corrupt data or crash the process. Here the record says the trigger is an unsigned integer overflow in a counter, reached when a single packet generates excessive alerts.
The vector shows high attack complexity, with integrity and availability both rated high. The advisory points to rulesets as the lever: untrusted rules, or a very large number of signatures matching the same packet, are what create the condition.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The sibling issue fixed in the same releases is CVE-2026-22262, a stack overflow in dataset saving.
Try it yourself
Fixes like this arrive between releases of your own software. See how continuous monitoring keeps up with them.
Click through it at your own pace, or open it full screen.
Quick check
Can ruleset hygiene alone protect me?
It lowers the risk, and the advisory lists it as a workaround. Upgrading to 7.0.14 or 8.0.3 is the actual fix.
Is this exploited in the wild?
The record does not say so and it is not on the CISA KEV list.
Sources
Last reviewed: 19 October 2026.
