This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-57225 →

DEBIAN-CVE-2026-57225

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/data...

Original description

The description as published by the source.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 suricata

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 suricata

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0.6-1"}]}]

References

advisory security-tracker.debian.org