CVE-2026-45764

A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially...

CVE-2026-45769

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A remote attacker can exploit this vulnerability by sending repeated crafted User Datagram Protocol UDP traffic to the IKEv2 parser. This can cause the...

CVE-2026-45766

A flaw was found in Suricata, a network Intrusion Detection System. Insufficiently bounded Network File System NFS parser state structures can be exploited by a remote attacker sending crafted NFS traffic. This can cause Suricata to consume excessive memory, leading to a denial of service...

CVE-2026-45768

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. The LDAP Lightweight Directory Access Protocol transaction state could store an unbounded number of responses. A remote attacker could send crafted UDP User...

MSMQ-Vulnerability

MSMQ 安全实验室 该仓库记录了关于 Microsoft 消息队列安全暴露的受控实验室审查，重点关注防御性验证、检测证据和修复规划。 该项目定位为作品集工件：展示如何将漏洞研究转化为证据收集、检测工程、缓解规划和验证。 项目目的 本项目的目的是记录一个作品集安全实验室，将漏洞研究与实际防御工作联系起来。 范围 本仓库关注： 实验室环境说明 MSMQ 服务暴露审查 网络抓包证据 Windows 事件查看器观察结果 Snort 和 Suricata 检测示例 缓解与补丁验证清单 截图和日志的证据索引 仓库结构 root@kitploit: MSMQ-Vulnerability/ ├──...

spookyssl-pcaps

SpookySSL PCAP 与网络覆盖 没有 PCAP 就等于没发生过 在最近披露的 OpenSSL v3.0 至 v3.0.6 漏洞（CVE-2022-3602）之后，我们研究了利用尝试在“网络上”是如何呈现的。本仓库包含各种利用场景的 PCAP 文件，以及 Suricata 的检测规则。 此外还包含一个 PCAP，其中包含一个合法证书的交换过程，该证书的主题备用名称中包含一个 punycode 编码的电子邮件地址。我们使用此 PCAP 来测试规则是否不会对仅包含较短主题备用名称的证书产生误报，而不是我们在利用尝试中预期的那种非常长的名称。 PCAP 文件...

Urgent11-Suricata-LUA-scripts

Urgent11-Suricata-LUA-scripts 用于检测CVE-2019-12255、CVE-2019-12256、CVE-2019-12258和CVE-2019-12260的Suricata LUA脚本 CVE-2019-12255 该脚本检测CVE-2019-12255，被检查的数据包需要设置了PSH、ACK和URG标志，并且有效载荷大小超过1500字节。然后检查紧急指针的值是否设置为0，这会在易受攻击的设备上导致整数下溢。...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF 教育目的 / 防御目的 : このラボには意図的に脆弱性のあるアプリ Log4j 2.14.1 と JNDI エクスプロイトキットが含まれています。唯一 の目的は、隔離された環境で Log4Shell を検出・ブロックする方法を学ぶことです。インターネットにデプロイせず、あなたが所有していないシステムへの攻撃に使用しないでください。 Coraza WAF 動的モジュール + OWASP CRS v4 + カスタム JNDI ルールを統合した nginx を使用した Log4Shell...

signatures

Signatures 本仓库旨在提供一种轻松创建和分发检测签名的方式。 尽情发挥创意，打造属于你自己的检测解决方案，完全不受许可限制的束缚。 为助力打击恶意行为，我们坚定地将我们的工作贡献至公共领域，以造福全世界。 🎉 下载已编译的签名 登录 GitHub 前往 actions 从 master 分支下载最新构建 依赖项 root@kitploit: sudo apt update sudo apt install make parallel docker.io jq sudo usermod -a -G docker $USER sudo systemctl enable docker...

suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 CVE-2025-53770 的检测规则 root@kitploit: alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, toserver; http.uri;...

CVE-2026-45763

A flaw was found in Suricata. When Lua rule execution is enabled, a remote attacker could exploit certain Lua allocation patterns to bypass the intended memory limits. This could lead to the Suricata engine consuming excessive memory, resulting in a Denial of Service DoS condition...

CVE-2026-45761

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A local attacker, by providing a specially crafted rule with mixed-case frame syntax, could trigger a heap buffer overflow. This vulnerability occur...

CVE-2026-45752

A flaw was found in Suricata, a network Intrusion Detection System. When specific detection transforms are chained, the decompress transform pipeline can attempt to read from an inspection buffer after it has been reallocated and freed. This use-after-free vulnerability can be triggered by a...

CVE-2026-45751

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a use-after-free vulnerability in the inspection-buffer helper. This occurs when a chained transform reallocates a buffer, leaving an inspection pointer referencing freed memory. This issue,...

CVE-2026-46387

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. A remote attacker could send a specially crafted HTTP/2 DATA payload with a high compression ratio. This could cause Suricata's HTTP/2 decompression path to...

CVE-2026-45770

A flaw was found in Suricata, a network Intrusion Detection System. A specially crafted Lua rule that registers an excessive number of flow variables can corrupt the Lua detection state. This could allow an attacker to bypass Suricata's restricted Lua sandbox, potentially leading to unauthorized...

CVE-2026-45762

A flaw was found in Suricata, a network Intrusion Detection System. The IP defragmentation tracker lookup did not properly verify the IP address family of incoming packets. A remote attacker could send specially crafted fragmented IPv4/IPv6 traffic, causing an IPv6 fragment to be incorrectly...

CVE-2026-45759

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A remote attacker could exploit this vulnerability by sending crafted HTTP traffic with large Content-Disposition headers. This could lead to...

CVE-2026-45747

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a NULL dereference vulnerability in the Lua TLS certificate information helper. This vulnerability occurs when a Lua script attempts to retrieve certificate details from TLS Transport Layer Securit...

Linux Distros Unpatched Vulnerability : CVE-2026-46387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,...