CVE-2026-45751 is a medium severity (CVSS 5.9) use after free in the Suricata IDS and IPS engine. A chained transform can leave an inspection pointer on freed memory. Upgrade to Suricata 7.0.16 or 8.0.5, or avoid rules that chain the dotprefix transform.
What's affected
- Suricata 7.x: versions before 7.0.16. Fixed in 7.0.16.
- Suricata 8.x: versions before 8.0.5. Fixed in 8.0.5.
The GitHub advisory describes the impact as availability only (CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9, Moderate), which matches the record. It is reached during specific traffic processing and needs a specific but not malicious rule, meaning an ordinary rule written in a certain way rather than a planted one.
How to check if you're exposed
Check the engine version:
suricata -V
Then search your rule files for the transform named in the workaround:
grep -rn "dotprefix" /etc/suricata/rules/ /var/lib/suricata/rules/
Your rule directories may differ, so adjust the paths. A hit that chains dotprefix after another transform is the pattern the advisory warns about. If you use managed rule sets, check the rule files after each update, not only your own custom rules.
What to do now
- Upgrade to Suricata 7.0.16 or 8.0.5 or later. Packaged distributions may carry the fix under their own version number, so read the package changelog.
- Until you upgrade, avoid rules that chain the
dotprefixtransform after another transform, as the advisory suggests. - Run Suricata under a supervisor so it restarts after a crash, and alert on unexpected restarts.
- Confirm sensors are healthy after the update by checking that traffic counters keep moving.
Why it matters
The cause is CWE-416, use after free. A helper that manages the inspection buffer could keep a pointer to memory that had been freed, after a chained transform caused the backing buffer to be reallocated. Later reads through that pointer touch memory that no longer belongs to it.
For a network sensor, availability matters. A crash can leave a segment uninspected until the process restarts, which is a quiet kind of damage. The record does not mark the issue as known exploited and the advisory scores it as Moderate.
Sensors are easy to forget during patch cycles because they run quietly. Keep a list of every Suricata instance, its version and the rule sets it loads, and review that list whenever a security release is announced.
Quick check
Does this need an attacker to write a rule?
No. The advisory says it requires a specific but not malicious rule. An ordinary rule that chains the transform in the affected way is enough, together with matching traffic.
What is the interim workaround?
Avoid rules that chain the dotprefix transform after another transform.
Sources
Last reviewed: 18 October 2026.
