CVE-2026-57228 is a high severity (CVSS 8.2) out-of-bounds read in Suricata's SMTP MIME decoder, versions 7.0.13 up to 7.0.17. Crafted SMTP traffic can crash the sensor. Upgrade to 7.0.17, or turn off quoted-printable decoding as a workaround. A workaround is to switch off quoted-printable decoding.
What's affected
The Suricata advisory (GHSA-qxm4-q7vx-7xj4) lists versions from 7.0.13 up to but not including 7.0.17 as affected, and 7.0.17 as patched. The 8.x branch is not listed in the advisory.
The flaw is in the quoted-printable decoder in src/util-decode-mime.c. It can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the next chunk is exactly one byte. The advisory says this can lead to a crash.
It matters because Suricata sits on the wire and inspects traffic from outsiders. A crash of a sensor, especially one in line, means a gap in detection or in traffic flow.
How to check if you're exposed
suricata --build-info
suricata -V
- A version from 7.0.13 to 7.0.16 is affected.
- Check whether SMTP decoding of quoted-printable content is enabled in suricata.yaml. The workaround setting is under app-layer, protocols, smtp, mime.
- Check container images and appliances that embed Suricata.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Suricata to 7.0.17 or later.
- As a workaround, set decode-quoted-printable to no in the SMTP mime section of suricata.yaml, then reload.
- Monitor sensor health, since a crash would show as a restart or missing events.
- If Suricata runs in line, make sure fail open or high availability behavior is what you want.
- Tell appliance vendors who embed Suricata to confirm their fix status.
Why it matters
The weakness is CWE-125, out-of-bounds read. A decoder saved part of an escape sequence between chunks, and when the next chunk was too short it read beyond the buffer. Streaming parsers are prone to this, since state carries across chunk boundaries and each boundary case needs a test.
The score is high because the attack travels over the network, needs no privileges, and can stop the sensor. The advisory credits Trail of Bits, working with Anthropic. Security tools are software too, and they need patching as quickly as the systems they watch. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What does the workaround cost me?
It stops decoding of quoted-printable email bodies for inspection, so rules that rely on decoded content may miss matches. Upgrade as soon as you can.
Sources
Last reviewed: 19 October 2026.
