CVE-2026-71855 is a medium severity (CVSS 5.9) flaw in Suricata before 7.0.17 and 8.0.6. Flow matching can treat an IPv4 flow and an IPv6 flow as the same, which can cause wrong flowbit state and detection bypass. The fix is Suricata 7.0.17 or 8.0.6.
What's affected
Suricata before 7.0.17 on the 7.0 line and before 8.0.6 on the 8.0 line, fixed in 7.0.17 and 8.0.6, per the record and the GitHub release pages, which show both released on 7 July.
The weakness is CWE-697, incorrect comparison. In src/flow-hash.c, flow lookup can consider an IPv4 flow and an IPv6 flow equal without comparing the IP family, when their raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket line up. An IPv6 packet can then reuse IPv4 flow state, or the reverse. The record lists the effects as incorrect flowbit state, detection bypass, or IP-only bypass.
The vector is AV:N/AC:H with high integrity impact and no confidentiality or availability impact. The high complexity reflects the narrow conditions that must line up.
How to check if you're exposed
Read the installed version on each sensor:
suricata -V
Versions before 7.0.17 on the 7.0 line, and before 8.0.6 on the 8.0 line, are affected. Packaged builds from distributions may carry backported fixes, so check the distribution notice for the exact package version if you use one.
Sensors are easy to forget. Check every place Suricata runs: network sensors, firewalls with an embedded IDS, container based deployments, and any appliance that bundles it. For appliances, the vendor controls the version, so ask them.
free in-browser dependency scan is for application dependencies, so use the sensor command line for version checks.
What to do now
- Run suricata -V on every sensor and appliance.
- Upgrade to 7.0.17 on the 7.0 line or 8.0.6 on the 8.0 line.
- Check vendor packages and appliances for the same fix.
- After upgrading, restart the engine and confirm the new version is the running one.
- Review rules that rely on flowbits for logic where IPv4 and IPv6 traffic share the same network.
Why it matters
CWE-697 is an incorrect comparison: two things are treated as equal when they are not. Here the missing field is the address family. The raw words of an IPv4 address and part of an IPv6 address can be identical, so only the family tells them apart.
The damage is to trust in a detection tool. Flow state decides which rules apply to a connection. If state from one flow leaks into another, a signature that should fire may not, which is the detection bypass the record describes. The conditions are narrow, so the score is medium, but intrusion detection exists to catch the unusual traffic where such conditions are most likely to be engineered.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this create a new way into my network?
No. It affects the sensor's detection logic, not your servers. The risk is that some malicious traffic may not be flagged, which is why upgrading the sensor matters.
Sources
Last reviewed: 18 October 2026.
