CVE WatchSep 18, 2026

CVE-2026-63449

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6

CVSS

3.7

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 18, 2026 · Last modified: Sep 18, 2026 · CWE-197

EPSS · 30d

Not enough EPSS history yet.

Technical description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-196677.5 HIG

40.9%

——12If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.2d CVE-2026-76151—

49.3%

——15Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.10h CVE-2026-875299.6 CRI

39.2%

——12Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)9d CVE-2026-785128.8 HIG

55.6%

——17Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.1d CVE-2026-698227.8 HIG

24.1%

——7Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.2d CVE-2026-695787.0 HIG

10.0%

——3Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally.4d