{"id":"CVE-2026-71855","summary":"Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state","details":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.","aliases":["GHSA-fvwh-wjcq-2586"],"modified":"2026-09-20T08:19:51.370112Z","published":"2026-09-18T20:25:58.646Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-697"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71855.json"},"references":[{"type":"WEB","url":"https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"},{"type":"WEB","url":"https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"},{"type":"WEB","url":"https://redmine.openinfosecfoundation.org/issues/8558"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71855.json"},{"type":"ADVISORY","url":"https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71855"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/suricata","events":[{"introduced":"9956286fb89f9cad9e9f95b99dc751f8666617b7"},{"introduced":"0"},{"fixed":"4c28cc1b4ac64f48efdca6ce3e09748227a04a7e"},{"fixed":"f707f3208de8216e4eccada5c10e6edce460a82a"},{"fixed":"181b3b2fdd1fe87e4534de4fc79e29a083ef125f"},{"fixed":"4e2f23d031fbcfd72883bacd3d723c9874f23701"},{"fixed":"bc41dcc854e24487d3786ce578a8a86a8350ab20"}],"database_specific":{"extracted_events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"},{"introduced":"0"},{"fixed":"7.0.17"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["suricata-7.0.16","suricata-8.0.5","suricata-8.0.4","suricata-7.0.15","suricata-7.0.14","suricata-8.0.3","suricata-8.0.2","suricata-7.0.13","suricata-7.0.12","suricata-8.0.1","suricata-8.0.0","suricata-7.0.11","suricata-7.0.10","suricata-7.0.9","suricata-7.0.8","suricata-7.0.7","suricata-7.0.6","suricata-7.0.5","suricata-7.0.4","suricata-7.0.3","suricata-7.0.2","suricata-7.0.1","suricata-7.0.0","suricata-7.0.0-rc2","suricata-7.0.0-rc1","suricata-7.0.0-beta1","suricata-6.0.1","suricata-6.0.0","suricata-6.0.0-rc1","suricata-6.0.0-beta1","suricata-5.0.1","suricata-5.0.0","suricata-5.0.0-rc1","suricata-5.0.0-beta1","suricata-4.1.2","suricata-4.1.1","suricata-4.1.0","suricata-4.1.0-rc2","suricata-4.1.0-rc1","suricata-4.1.0-beta1","suricata-4.0.1","suricata-4.0.0","suricata-4.0.0-rc2","suricata-4.0.0-rc1","suricata-4.0.0-beta1","suricata-3.2.1","suricata-3.2","suricata-3.2RC1","suricata-3.2beta1","suricata-3.1.2","suricata-3.1.1","suricata-3.1","suricata-3.0.1","suricata-3.1RC1","suricata-3.0.1RC1","suricata-3.0","suricata-3.0RC3","suricata-3.0RC2","suricata-3.0RC1","suricata-2.1beta4","suricata-2.1beta3","suricata-2.1beta2","suricata-2.1beta1","suricata-2.0.2","suricata-2.0.1","suricata-2.0.1rc1","suricata-2.0","suricata-2.0rc3","suricata-2.0rc2","suricata-2.0rc1","suricata-2.0beta2","suricata-2.0beta1","suricata-1.4","suricata-1.4rc1","suricata-1.4beta3","suricata-1.4beta2","suricata-1.4beta1","suricata-1.3.1","suricata-1.3","suricata-1.3rc1","suricata-1.3beta2","suricata-1.3beta1","suricata-1.2.1","suricata-1.2","suricata-1.2rc1","suricata-1.2beta1","suricata-1.1","suricata-1.1rc1","suricata-1.1beta3","suricata-1.1beta2","suricata-1.1beta1","suricata-1.0.2","suricata-1.0.1","suricata-1.0.0","suricata-0.8.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71855.json","vanir_signatures_modified":"2026-09-20T08:19:51Z","vanir_signatures":[{"id":"CVE-2026-71855-027e6b00","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20","target":{"file":"src/flow-hash.c","function":"CmpFlowKey"},"deprecated":false,"digest":{"function_hash":"236209030755020059145548972010149918396","length":526}},{"id":"CVE-2026-71855-15f29483","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701","target":{"function":"FlowCompareICMPv4","file":"src/flow-hash.c"},"deprecated":false,"digest":{"function_hash":"69659413636495128065316647738688189593","length":1219}},{"source":"https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f","target":{"file":"src/flow-hash.c","function":"FlowCompareICMPv4"},"deprecated":false,"digest":{"function_hash":"218410489270487691551407570947121476480","length":1131},"id":"CVE-2026-71855-5610cdf8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f","target":{"file":"src/flow-hash.c"},"deprecated":false,"digest":{"line_hashes":["141327004229805105877610176341865989108","69957804880965757790576556423800357832","303877092609930084972876612695842143257","157016514376650525695164066849446512675","23959889372819116111889154617862630720","17979798614245357894396748864028704228","252336332357387533815994276238949327646","3349738835845813850606443831092855344","142989429647097273730943001955023044410","212887953497985350989909880111029243000","8754996709367057267082575171830000271","36145710259898134654179896804160785968","8637387445841497707637300563120139733","195169517989824117339074724177554944502","102398156176329199582505398755834252177","36145710259898134654179896804160785968","234475904497579886804281878321678042142","285833035822140376568463819527177777490","285027182050149904910465482090217820851","122943558148947803872863067734328540045"],"threshold":0.9},"id":"CVE-2026-71855-5d6a1005","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-71855-6749a3e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20","target":{"file":"src/flow-hash.c","function":"FlowCompareESP"},"deprecated":false,"digest":{"length":535,"function_hash":"271705603215869666569696830015896205549"}},{"digest":{"function_hash":"180213095077550415569060978719370100713","length":665},"id":"CVE-2026-71855-67651e94","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701","target":{"function":"CmpFlowKey","file":"src/flow-hash.c"},"deprecated":false},{"source":"https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f","target":{"file":"src/flow-hash.c","function":"CmpFlowPacket"},"deprecated":false,"digest":{"length":649,"function_hash":"122308652378826505225423304544221841118"},"id":"CVE-2026-71855-6a1c5d7b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/flow-hash.c","function":"FlowCompareESP"},"deprecated":false,"digest":{"function_hash":"5191607490968707861009843687877810060","length":645},"id":"CVE-2026-71855-86f17e7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f"},{"deprecated":false,"digest":{"function_hash":"163939305405265559687888312771223462818","length":686},"id":"CVE-2026-71855-95be8018","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701","target":{"file":"src/flow-hash.c","function":"FlowCompareESP"}},{"deprecated":false,"digest":{"function_hash":"337067938375513922304311125043494005403","length":1201},"id":"CVE-2026-71855-96db2f64","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20","target":{"file":"src/flow-hash.c","function":"FlowCompareICMPv4"}},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20","target":{"file":"src/flow-hash.c","function":"CmpFlowPacket"},"deprecated":false,"digest":{"function_hash":"236209030755020059145548972010149918396","length":526},"id":"CVE-2026-71855-97e5dd72","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f","target":{"file":"src/flow-hash.c","function":"CmpFlowKey"},"deprecated":false,"digest":{"function_hash":"177653551381862350339714676077078807645","length":637},"id":"CVE-2026-71855-a26289c8","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20","target":{"file":"src/flow-hash.c"},"deprecated":false,"digest":{"line_hashes":["308136909102982758039929981635100295375","64976554387565202929911289722749990136","283996566176214207675344327908057601576","206946203363182334706629019596002064688","216583839989192884551607276286483558666","218978273252187834096039292303806568394","8777720791612348270933763595191955055","310614824539284501617577249870259775881","107430768313570505524119240947565133076","292542125969678500550427122042896517247","2630201858623184146462501906798718251","20413637455366523640279036095819690244","79813708871464178497707183884482350255","37973625254495496459680422691141887990","15959292465078986686198048342521164931","14712368031112799246153882260672879433","174498336600199486565433299289323887209","177273967071334629917389611554989581167","318316741789583716787918719928367802252","330241865927356483455619148752857389134"],"threshold":0.9},"id":"CVE-2026-71855-a8064aba","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["158138031154032441018532547706852250940","77869919401399228114682731230945228918","204445217615720873213969097368611415779","35614976937633548285489105444569971323","42086596569518623475764807754211712929","277000281502203364856147292098168932758","126614355156968232085613625378058789041","212642155295224823370478680497409333371","107430768313570505524119240947565133076","292542125969678500550427122042896517247","253993808570040189199657731564845013969","174867850444427870055668122826372820188","79813708871464178497707183884482350255","37973625254495496459680422691141887990","15959292465078986686198048342521164931","174867850444427870055668122826372820188","201846038320530534130909547082881301544","60504002822925274853980007011789132647","175533589902433818432504579734318185187","300795860521175125912060961739317293516"],"threshold":0.9},"id":"CVE-2026-71855-b0a0474a","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701","target":{"file":"src/flow-hash.c"}},{"deprecated":false,"digest":{"function_hash":"121185913287454534268845072639165701048","length":677},"id":"CVE-2026-71855-d546da90","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701","target":{"file":"src/flow-hash.c","function":"CmpFlowPacket"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}