# cve.now: Oisf

The newest entries naming Oisf as an affected vendor (up to 200), of 90 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94084](https://cve.now/CVE-2026-94084.md): Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response\_header with (CVSS 9.4)
- [CVE-2026-94083](https://cve.now/CVE-2026-94083.md): Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even th (CVSS 9.4)
- [CVE-2026-71855](https://cve.now/CVE-2026-71855.md): Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state (CVSS 5.9)
- [CVE-2026-71418](https://cve.now/CVE-2026-71418.md): Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption (CVSS 7.5)
- [CVE-2026-57223](https://cve.now/CVE-2026-57223.md): Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation (CVSS 7.0)
- [CVE-2026-63446](https://cve.now/CVE-2026-63446.md): Suricata app-layer: passed flows can retain transactions, causing resource exhaustion (CVSS 7.5)
- [CVE-2026-63447](https://cve.now/CVE-2026-63447.md): Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption (CVSS 7.5)
- [CVE-2026-63448](https://cve.now/CVE-2026-63448.md): Suricata smb: some SMB flows can cause resource exhaustion (CVSS 5.9)
- [CVE-2026-57229](https://cve.now/CVE-2026-57229.md): Suricata smtp/mime: incomplete state reset allows detection bypass (CVSS 5.3)
- [CVE-2026-57225](https://cve.now/CVE-2026-57225.md): Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading (CVSS 3.3)
- [CVE-2026-63452](https://cve.now/CVE-2026-63452.md): Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption (CVSS 7.5)
- [CVE-2026-63451](https://cve.now/CVE-2026-63451.md): Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load (CVSS 3.3)
- [CVE-2026-57227](https://cve.now/CVE-2026-57227.md): Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages (CVSS 7.5)
- [CVE-2026-63450](https://cve.now/CVE-2026-63450.md): Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection (CVSS 3.7)
- [CVE-2026-63449](https://cve.now/CVE-2026-63449.md): Suricata sip: large SIP message bodies can evade detection with frame keyword (CVSS 3.7)
- [CVE-2026-57228](https://cve.now/CVE-2026-57228.md): Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder (CVSS 8.2)
- [CVE-2026-57224](https://cve.now/CVE-2026-57224.md): Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion (CVSS 6.5)
- [CVE-2026-57226](https://cve.now/CVE-2026-57226.md): Suricata swf: heap buffer overflow in SWF decompression depth handling (CVSS 3.7)
- [CVE-2026-57222](https://cve.now/CVE-2026-57222.md): Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 (CVSS 5.3)
- [CVE-2026-46352](https://cve.now/CVE-2026-46352.md): Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock (CVSS 7.5)
- [CVE-2026-45770](https://cve.now/CVE-2026-45770.md): Suricata lua: excessive flow variable registration can bypass sandbox (CVSS 7.5)
- [CVE-2026-45769](https://cve.now/CVE-2026-45769.md): ikev2: unbounded client transform storage can lead to resource exhaustion (CVSS 7.5)
- [CVE-2026-45768](https://cve.now/CVE-2026-45768.md): Suricata ldap: unbounded responses per transaction can lead to resource exhaustion (CVSS 7.5)
- [CVE-2026-45767](https://cve.now/CVE-2026-45767.md): Suricata datasets: save to absolute filename can be bypassed when combined with load command (CVSS 4.4)
- [CVE-2026-45766](https://cve.now/CVE-2026-45766.md): Suricata nfs: unbounded stateful structures can lead to resource exhaustion (CVSS 7.5)
- [CVE-2026-45765](https://cve.now/CVE-2026-45765.md): Suricata dnp3: unbounded reassembly can lead to resource exhaustion (CVSS 7.5)
- [CVE-2026-45764](https://cve.now/CVE-2026-45764.md): Suricata http2: protocol-change type confusion can lead to denial of service (CVSS 9.1)
- [CVE-2026-45762](https://cve.now/CVE-2026-45762.md): Suricata defrag: missing address-family check can lead to remote crash (CVSS 7.5)
- [CVE-2026-45761](https://cve.now/CVE-2026-45761.md): Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load (CVSS 3.3)
- [CVE-2026-45759](https://cve.now/CVE-2026-45759.md): Suricata http1: quadratic Content-Disposition processing can lead to denial of service (CVSS 7.5)
- [CVE-2026-45752](https://cve.now/CVE-2026-45752.md): Suricata detect/transform: use-after-free in decompress transforms (CVSS 5.9)
- [CVE-2026-45751](https://cve.now/CVE-2026-45751.md): Suricata detect/transform: use-after-free in dotprefix transform (CVSS 5.9)
- [CVE-2026-45747](https://cve.now/CVE-2026-45747.md): Suricata lua/tls: null dereference in TlsGetCertInfo (CVSS 7.5)
- [CVE-2026-46387](https://cve.now/CVE-2026-46387.md): Suricata http2: decompression bomb can cause denial of service in Suricata (CVSS 7.5)
- [CVE-2026-45763](https://cve.now/CVE-2026-45763.md): Suricata lua: sandbox allocation limit not enforced for new allocations (CVSS 5.9)
- [CVE-2026-31937](https://cve.now/CVE-2026-31937.md): Suricata dcerpc: quadratic complexity in dcerpc buffering (CVSS 7.5)
- [CVE-2026-31935](https://cve.now/CVE-2026-31935.md): Suricata http2: unbounded resource consumption (CVSS 7.5)
- [CVE-2026-31934](https://cve.now/CVE-2026-31934.md): Suricata smtp/mine: quadratic complexity in extracting urls (CVSS 7.5)
- [CVE-2026-31933](https://cve.now/CVE-2026-31933.md): Suricata stream: quadratic complexity in stream inspection (CVSS 7.5)
- [CVE-2026-31932](https://cve.now/CVE-2026-31932.md): Suricata krb5: quadratic complexity in krb5 buffering (CVSS 7.5)
- [CVE-2026-31931](https://cve.now/CVE-2026-31931.md): Suricata tls: null dereference in tls.alpn rule keyword (CVSS 7.5)
- [CVE-2026-22264](https://cve.now/CVE-2026-22264.md): Suricata detect/alert: heap-use-after-free on alert queue expansion (CVSS 7.4)
- [CVE-2026-22263](https://cve.now/CVE-2026-22263.md): Suricata http1: quadratic complexity in headers parsing over multiple packets (CVSS 5.3)
- [CVE-2026-22262](https://cve.now/CVE-2026-22262.md): Suricata datasets: stack overflow when saving a set (CVSS 5.9)
- [CVE-2026-22261](https://cve.now/CVE-2026-22261.md): Suricata eve/alert: http1 xff handling can lead to denial of service (CVSS 3.7)
- [CVE-2026-22260](https://cve.now/CVE-2026-22260.md): Suricata http1: infinite recursion in decompression (CVSS 7.5)
- [CVE-2026-22259](https://cve.now/CVE-2026-22259.md): Suricata dnp3: unbounded transaction growth (CVSS 7.5)
- [CVE-2026-22258](https://cve.now/CVE-2026-22258.md): Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion (CVSS 7.5)
- [CVE-2025-64344](https://cve.now/CVE-2025-64344.md): Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer (CVSS 7.5)
- [CVE-2025-64330](https://cve.now/CVE-2025-64330.md): Suricata is vulnerable to a heap buffer overflow on verdict (CVSS 7.5)
- [CVE-2025-64331](https://cve.now/CVE-2025-64331.md): Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable (CVSS 7.5)
- [CVE-2025-64332](https://cve.now/CVE-2025-64332.md): Suricata is vulnerable to a stack overflow on larger compressed data (CVSS 7.5)
- [CVE-2025-64333](https://cve.now/CVE-2025-64333.md): Suricata is vulnerable to a stack overflow from big content-type (CVSS 7.5)
- [CVE-2025-64335](https://cve.now/CVE-2025-64335.md): Suricata is vulnerable to a null deref when used with base64\_data (CVSS 7.5)
- [CVE-2025-64334](https://cve.now/CVE-2025-64334.md): Suricata is vulnerable to unbounded memory growth for decompression (CVSS 7.5)
- [CVE-2025-59150](https://cve.now/CVE-2025-59150.md): Suricata: Keyword tls.subjectaltname can lead to NULL-ptr deref (CVSS 7.5)
- [CVE-2025-59149](https://cve.now/CVE-2025-59149.md): Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms (CVSS 6.2)
- [CVE-2025-59148](https://cve.now/CVE-2025-59148.md): Suricata's improper use of entropy keyword can lead to a NULL-ptr deref (CVSS 7.5)
- [CVE-2025-59147](https://cve.now/CVE-2025-59147.md): Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets (CVSS 7.5)
- [CVE-2025-53537](https://cve.now/CVE-2025-53537.md): LibHTP's memory leak with lzma can lead to resource starvation (CVSS 7.5)
- [CVE-2025-53538](https://cve.now/CVE-2025-53538.md): Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation (CVSS 7.5)
- [CVE-2025-29918](https://cve.now/CVE-2025-29918.md): Suricata pcre: negated pcr can cause infinite loop (CVSS 6.2)
- [CVE-2025-29917](https://cve.now/CVE-2025-29917.md): Suricata decode\_base64: signature can do large memory allocation (CVSS 6.2)
- [CVE-2025-29916](https://cve.now/CVE-2025-29916.md): Suricata datasets: ruleset declared settings can lead to resource starvation (CVSS 6.2)
- [CVE-2025-29915](https://cve.now/CVE-2025-29915.md): Suricata af-packet: defrag option can lead to truncated packets affecting visibility (CVSS 7.5)
- [CVE-2024-55629](https://cve.now/CVE-2024-55629.md): Suricata generic detection bypass using TCP urgent support (CVSS 7.5)
- [CVE-2024-55628](https://cve.now/CVE-2024-55628.md): Suricata oversized resource names utilizing DNS name compression can lead to resource starvation (CVSS 7.5)
- [CVE-2024-55627](https://cve.now/CVE-2024-55627.md): Suricata segfault on StreamingBufferSlideToOffsetWithRegions (CVSS 5.9)
- [CVE-2024-55626](https://cve.now/CVE-2024-55626.md): Suricata oversized bpf file can lead to buffer overflow (CVSS 3.3)
- [CVE-2024-55605](https://cve.now/CVE-2024-55605.md): Suricata allows stack overflow in transforms (CVSS 7.5)
- [CVE-2024-47522](https://cve.now/CVE-2024-47522.md): Suricata ja4: invalid alpn leads to panic (CVSS 7.5)
- [CVE-2024-47188](https://cve.now/CVE-2024-47188.md): Suricata http/byte-ranges: missing hashtable random seed leads to potential DoS (CVSS 7.5)
- [CVE-2024-47187](https://cve.now/CVE-2024-47187.md): Suricata datasets: missing hashtable random seed leads to potential DoS (CVSS 7.5)
- [CVE-2024-45797](https://cve.now/CVE-2024-45797.md): LibHTP's unbounded header handling leads to denial service (CVSS 7.5)
- [CVE-2024-45796](https://cve.now/CVE-2024-45796.md): Suricata defrag: off by one can lead to policy bypass (CVSS 5.3)
- [CVE-2024-45795](https://cve.now/CVE-2024-45795.md): Suricata detect/datasets: reachable assertion with unimplemented rule option (CVSS 7.5)
- [CVE-2024-38536](https://cve.now/CVE-2024-38536.md): Suricata http/range: NULL-ptr deref when http.memcap is reached (CVSS 7.5)
- [CVE-2024-38535](https://cve.now/CVE-2024-38535.md): Suricata http2: oom from duplicate headers (CVSS 7.5)
- [CVE-2024-38534](https://cve.now/CVE-2024-38534.md): Suricata modbus: txs without responses are never freed (CVSS 7.5)
- [CVE-2024-37151](https://cve.now/CVE-2024-37151.md): Suricata defrag: IP ID reuse can lead to policy bypass (CVSS 5.3)
- [CVE-2024-32867](https://cve.now/CVE-2024-32867.md): Suricata's defrag contains various issues leading to policy bypass (CVSS 5.3)
- [CVE-2024-32664](https://cve.now/CVE-2024-32664.md): Suricata's base64 contains an out of bounds write (CVSS 5.3)
- [CVE-2024-32663](https://cve.now/CVE-2024-32663.md): Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation (CVSS 7.5)
- [CVE-2024-28871](https://cve.now/CVE-2024-28871.md): Excessive CPU used on malformed traffic (CVSS 7.5)
- [CVE-2024-28870](https://cve.now/CVE-2024-28870.md): Suricata uses excessive resource use in malformed ssh traffic parsing (CVSS 7.5)
- [CVE-2024-23837](https://cve.now/CVE-2024-23837.md): LibHTP unbounded folded header handling leads to denial service (CVSS 7.5)
- [CVE-2024-24568](https://cve.now/CVE-2024-24568.md): Suricata http2: header handling evasion (CVSS 5.3)
- [CVE-2024-23839](https://cve.now/CVE-2024-23839.md): Suricata http: heap use after free with http.request\_header and http.response\_header keywords (CVSS 7.1)
- [CVE-2024-23836](https://cve.now/CVE-2024-23836.md): crafted traffic can cause denial of service (CVSS 7.5)
- [CVE-2024-23835](https://cve.now/CVE-2024-23835.md): Suricata's pgsql: memory exhaustion use on record parsing (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/oisf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.