Security readout for executives and security teams
Plain-English summary
CVE-2026-22262 affects Suricata, a widely used network detection engine. A large dataset saved by certain rule features can overflow a stack buffer and crash or disrupt the service. The business impact is reduced network monitoring or prevention availability, not confirmed data theft or tampering.
Executive priority
Prioritize for teams relying on Suricata for inline prevention or high-value monitoring. This is not a confirmed breach-enabling issue, but it can impair detection availability. Patch in normal security maintenance cycles, faster where rule configurations use datasets save or state.
Technical view
Suricata before 7.0.14 and 8.0.0 through 8.0.2 can hit a CWE-121 stack overflow while saving datasets. The issue is tied to dataset save handling when data is too large. CVSS 3.1 is 5.9: network reachable, high complexity, no privileges or user interaction, availability impact only.
Likely exposure
Organizations running Suricata versions below 7.0.14, or 8.0.0 to 8.0.2, are potentially exposed if rules use dataset save or state options. Exposure is most relevant where Suricata is deployed inline or relied on for critical detection coverage.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. The CVSS vector indicates network attack vector but high attack complexity. Practical risk depends on rule configuration, dataset usage, and whether service interruption would degrade security monitoring or traffic enforcement.
Researcher notes
Public details identify stack overflow during dataset persistence, with patches in 7.0.14 and 8.0.3. The advisory names a configuration workaround but does not provide exploit evidence in the supplied sources. Validate exposure by version branch and rule features rather than Suricata presence alone.
Mitigation direction
- Upgrade Suricata 7.x deployments to 7.0.14 or later.
- Upgrade Suricata 8.x deployments to 8.0.3 or later.
- As a workaround, avoid rules using dataset save or state options.
- Review OISF advisory and release guidance before operational changes.
Validation and detection
- Inventory all Suricata sensors and record installed versions.
- Identify rules using dataset save or state options.
- Confirm upgraded systems report Suricata 7.0.14, 8.0.3, or later.
- Check monitoring for Suricata crashes or unexpected restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22262 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/OISF/suricata/security/advisories/GHSA-9qg5-2gwh-xp86CVE reference · x_refsource_CONFIRM
- https://github.com/OISF/suricata/commit/0eff24213763c2aa2bb0957901d5dc1e18414dbfCVE reference · x_refsource_MISC
- https://github.com/OISF/suricata/commit/27a2180bceaa3477419c78c54fce364398d011f1CVE reference · x_refsource_MISC
- https://github.com/OISF/suricata/commit/32609e6896f9079c175665a94005417cec7637ebCVE reference · x_refsource_MISC
- https://github.com/OISF/suricata/commit/32a1b9ae6aa80a60c073897e38a2ac6ea0f64521CVE reference · x_refsource_MISC
- https://github.com/OISF/suricata/commit/d6bc718e303ecbec5999066b8bc88eeeca743658CVE reference · x_refsource_MISC
- https://github.com/OISF/suricata/commit/d767dfadcd166f82683757818b9e46943326ac90CVE reference · x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/8110CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.