External risk intelligence

Suricata SMTP MIME Decoder Out-of-Bounds Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-57228

Suricata is a network security monitoring engine typically deployed at network perimeters or as an inline intrusion detection/prevention system. Because it is designed to process incoming network traffic, including SMTP traffic, its decoding components are often exposed to external, potentially untrusted traffic streams, making it a common target for network-based threats.

Out-of-bounds Read

Oisf Suricata

7.0.13 to before 7.0.17

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Suricata, a network security monitoring tool. The vulnerability allows for a potential denial-of-service or information disclosure through crafted network traffic. The main concern is confirming relevance and exposure.

Vulnerability in network traffic decoding.
Affects network security monitoring systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target Suricata by sending specially crafted network traffic. If Suricata is configured to decode SMTP MIME messages and is processing traffic in chunks, an attacker could split a quoted-printable escape sequence across two traffic chunks. The vulnerability occurs when the second chunk contains exactly one byte, causing Suricata to read one byte beyond its allocated memory, potentially leading to a crash.

Network access required.
Crafted SMTP traffic triggers bug.
Leads to denial-of-service.

Live Threat

Current exploitation, exposure, and threat context

When Suricata's MIME decoding is enabled, specially crafted SMTP traffic could trigger an out-of-bounds read. This could lead to a crash, impacting the availability of network security monitoring and intrusion prevention services.

Network traffic inspection may be disrupted.
Maliciously crafted SMTP traffic could cause a crash.
Service availability for network security may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for network infrastructure, security monitoring, and application delivery should address this Suricata vulnerability, as it impacts network traffic processing. The initial practical step is to locate all Suricata deployments, confirm their reachability and criticality, identify the accountable owners, and then develop a targeted remediation plan.

Network and security teams should own this.
Verify Suricata's exposure and business impact.
Plan for urgent updates or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Suricata?

Suricata is an open-source network security engine used by organizations to monitor traffic, detect intrusions, and prevent malicious activity. It sits within the network infrastructure to inspect data packets—including protocols like SMTP—against defined rules to identify and block threats. It is widely used for network-based security monitoring and packet-level analysis.

What does CVE-2026-57228 mean?

This is an out-of-bounds read vulnerability, classified as CWE-125. It occurs when software accesses memory outside the intended buffer. In this case, Suricata's SMTP decoder incorrectly handles specific quoted-printable encoded data, potentially allowing the engine to read one byte beyond its allocated heap memory, which can lead to a system crash.

How is this vulnerability triggered?

An attacker must send specifically crafted SMTP traffic to the monitored network. The bug triggers only when the MIME quoted-printable decoder is enabled and an escape sequence is split between two traffic chunks, with the second chunk containing exactly one byte. Traffic that does not utilize this specific encoding or chunking behavior will not trigger this issue.

Is my Suricata deployment at risk?

According to Halo Surface Signal, this vulnerability is likely relevant to your environment if your Suricata instance processes untrusted, external network traffic. Because Suricata is often deployed at the network perimeter to inspect incoming data, its decoding components—like the one affected here—are frequently exposed to external, potentially malicious traffic streams.

What should I do to address this?

First, identify all instances of Suricata within your environment to determine which are running versions 7.0.13 through 7.0.16. Once identified, prioritize updating these systems to version 7.0.17 or later, as this release contains the fix. Coordinate with your network and security teams to verify exposure and schedule the update to maintain the integrity of your security monitoring.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.