CVE-2026-31933

{
  "id": "CVE-2026-31933",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-02T14:16:28.930",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4."
    },
    {
      "lang": "es",
      "value": "Suricata es un motor de IDS, IPS y NSM de red. Antes de las versiones 7.0.15 y 8.0.4, el tráfico especialmente diseñado puede hacer que Suricata se ralentice, afectando el rendimiento en modo IDS. Este problema ha sido parcheado en las versiones 7.0.15 y 8.0.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OISF",
          "product": "suricata",
          "versions": [
            {
              "version": "< 7.0.15",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.0.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-03T16:00:34.285774Z",
          "id": "CVE-2026-31933",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "7.0.15",
              "matchCriteriaId": "1E0D4CF4-11E0-4FB1-9C17-F38257D376ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.0.4",
              "matchCriteriaId": "F35C5A48-CA30-43B3-9E53-D3E51C862604"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://redmine.openinfosecfoundation.org/issues/8272",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ]
    }
  ]
}