CVE-2026-71855
- Source
- https://cve.org/CVERecord?id=CVE-2026-71855
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71855.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-71855
- Aliases
-
- GHSA-fvwh-wjcq-2586
- Downstream
- Published
- 2026-09-18T20:25:58Z
- Modified
- 2026-09-20T08:19:51Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
- Details
-
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-697" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71855.json" }- References
-
- https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
- https://redmine.openinfosecfoundation.org/issues/8558
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71855.json
- https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586
- https://nvd.nist.gov/vuln/detail/CVE-2026-71855
- https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f
- https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701
- https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20
Affected packages
Git / github.com/oisf/suricata
Affected ranges
- Type
- GIT
- Repo
- https://github.com/oisf/suricata
- Events
-
IntroducedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "8.0.6" }, { "introduced": "0" }, { "fixed": "7.0.17" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
suricata-0.*
suricata-0.8.2
suricata-1.*
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
suricata-1.2
suricata-1.2.1
suricata-1.2beta1
suricata-1.2rc1
suricata-1.3
suricata-1.3.1
suricata-1.3beta1
suricata-1.3beta2
suricata-1.3rc1
suricata-1.4
suricata-1.4beta1
suricata-1.4beta2
suricata-1.4beta3
suricata-1.4rc1
suricata-2.*
suricata-2.0
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0.2
suricata-2.0beta1
suricata-2.0beta2
suricata-2.0rc1
suricata-2.0rc2
suricata-2.0rc3
suricata-2.1beta1
suricata-2.1beta2
suricata-2.1beta3
suricata-2.1beta4
suricata-3.*
suricata-3.0
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0RC1
suricata-3.0RC2
suricata-3.0RC3
suricata-3.1
suricata-3.1.1
suricata-3.1.2
suricata-3.1RC1
suricata-3.2
suricata-3.2.1
suricata-3.2RC1
suricata-3.2beta1
suricata-4.*
suricata-4.0.0
suricata-4.0.0-beta1
suricata-4.0.0-rc1
suricata-4.0.0-rc2
suricata-4.0.1
suricata-4.1.0
suricata-4.1.0-beta1
suricata-4.1.0-rc1
suricata-4.1.0-rc2
suricata-4.1.1
suricata-4.1.2
suricata-5.*
suricata-5.0.0
suricata-5.0.0-beta1
suricata-5.0.0-rc1
suricata-5.0.1
suricata-6.*
suricata-6.0.0
suricata-6.0.0-beta1
suricata-6.0.0-rc1
suricata-6.0.1
suricata-7.*
suricata-7.0.0
suricata-7.0.0-beta1
suricata-7.0.0-rc1
suricata-7.0.0-rc2
suricata-7.0.1
suricata-7.0.10
suricata-7.0.11
suricata-7.0.12
suricata-7.0.13
suricata-7.0.14
suricata-7.0.15
suricata-7.0.16
suricata-7.0.2
suricata-7.0.3
suricata-7.0.4
suricata-7.0.5
suricata-7.0.6
suricata-7.0.7
suricata-7.0.8
suricata-7.0.9
suricata-8.*
suricata-8.0.0
suricata-8.0.1
suricata-8.0.2
suricata-8.0.3
suricata-8.0.4
suricata-8.0.5
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71855.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "236209030755020059145548972010149918396",
"length": 526
},
"id": "CVE-2026-71855-027e6b00",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowKey"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69659413636495128065316647738688189593",
"length": 1219
},
"id": "CVE-2026-71855-15f29483",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareICMPv4"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218410489270487691551407570947121476480",
"length": 1131
},
"id": "CVE-2026-71855-5610cdf8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareICMPv4"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141327004229805105877610176341865989108",
"69957804880965757790576556423800357832",
"303877092609930084972876612695842143257",
"157016514376650525695164066849446512675",
"23959889372819116111889154617862630720",
"17979798614245357894396748864028704228",
"252336332357387533815994276238949327646",
"3349738835845813850606443831092855344",
"142989429647097273730943001955023044410",
"212887953497985350989909880111029243000",
"8754996709367057267082575171830000271",
"36145710259898134654179896804160785968",
"8637387445841497707637300563120139733",
"195169517989824117339074724177554944502",
"102398156176329199582505398755834252177",
"36145710259898134654179896804160785968",
"234475904497579886804281878321678042142",
"285833035822140376568463819527177777490",
"285027182050149904910465482090217820851",
"122943558148947803872863067734328540045"
],
"threshold": 0.9
},
"id": "CVE-2026-71855-5d6a1005",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"target": {
"file": "src/flow-hash.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271705603215869666569696830015896205549",
"length": 535
},
"id": "CVE-2026-71855-6749a3e6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareESP"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "180213095077550415569060978719370100713",
"length": 665
},
"id": "CVE-2026-71855-67651e94",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowKey"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "122308652378826505225423304544221841118",
"length": 649
},
"id": "CVE-2026-71855-6a1c5d7b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "5191607490968707861009843687877810060",
"length": 645
},
"id": "CVE-2026-71855-86f17e7b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareESP"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "163939305405265559687888312771223462818",
"length": 686
},
"id": "CVE-2026-71855-95be8018",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareESP"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "337067938375513922304311125043494005403",
"length": 1201
},
"id": "CVE-2026-71855-96db2f64",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"target": {
"file": "src/flow-hash.c",
"function": "FlowCompareICMPv4"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236209030755020059145548972010149918396",
"length": 526
},
"id": "CVE-2026-71855-97e5dd72",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177653551381862350339714676077078807645",
"length": 637
},
"id": "CVE-2026-71855-a26289c8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowKey"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308136909102982758039929981635100295375",
"64976554387565202929911289722749990136",
"283996566176214207675344327908057601576",
"206946203363182334706629019596002064688",
"216583839989192884551607276286483558666",
"218978273252187834096039292303806568394",
"8777720791612348270933763595191955055",
"310614824539284501617577249870259775881",
"107430768313570505524119240947565133076",
"292542125969678500550427122042896517247",
"2630201858623184146462501906798718251",
"20413637455366523640279036095819690244",
"79813708871464178497707183884482350255",
"37973625254495496459680422691141887990",
"15959292465078986686198048342521164931",
"14712368031112799246153882260672879433",
"174498336600199486565433299289323887209",
"177273967071334629917389611554989581167",
"318316741789583716787918719928367802252",
"330241865927356483455619148752857389134"
],
"threshold": 0.9
},
"id": "CVE-2026-71855-a8064aba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"target": {
"file": "src/flow-hash.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158138031154032441018532547706852250940",
"77869919401399228114682731230945228918",
"204445217615720873213969097368611415779",
"35614976937633548285489105444569971323",
"42086596569518623475764807754211712929",
"277000281502203364856147292098168932758",
"126614355156968232085613625378058789041",
"212642155295224823370478680497409333371",
"107430768313570505524119240947565133076",
"292542125969678500550427122042896517247",
"253993808570040189199657731564845013969",
"174867850444427870055668122826372820188",
"79813708871464178497707183884482350255",
"37973625254495496459680422691141887990",
"15959292465078986686198048342521164931",
"174867850444427870055668122826372820188",
"201846038320530534130909547082881301544",
"60504002822925274853980007011789132647",
"175533589902433818432504579734318185187",
"300795860521175125912060961739317293516"
],
"threshold": 0.9
},
"id": "CVE-2026-71855-b0a0474a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"target": {
"file": "src/flow-hash.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121185913287454534268845072639165701048",
"length": 677
},
"id": "CVE-2026-71855-d546da90",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"target": {
"file": "src/flow-hash.c",
"function": "CmpFlowPacket"
}
}
]
vanir_signatures_modified
"2026-09-20T08:19:51Z"