CVE-2026-31931: NULL Pointer Dereference in Suricata

Successful exploitation of CVE-2026-31931 can lead to a denial-of-service (DoS) condition, effectively disrupting network monitoring and security operations. An attacker could craft malicious network traffic containing specific TLS ALPN configurations to trigger the crash. This could impact the availability of critical security functions, potentially allowing malicious activity to go undetected. The blast radius extends to any system relying on Suricata for network intrusion detection and prevention.

1. Reserved2026-03-10
2. Published2026-04-02
3. EPSS updated2026-04-10

The primary mitigation for CVE-2026-31931 is to upgrade Suricata to version 8.0.4 or later. If immediate upgrading is not feasible, consider temporarily disabling the 'tls.alpn' rule keyword within your Suricata configuration. While this reduces the engine's ability to inspect TLS ALPN extensions, it prevents the crash. Monitor Suricata logs for unexpected crashes or errors, which could indicate exploitation attempts. After upgrading, confirm the fix by testing the Suricata configuration with traffic containing TLS ALPN extensions to ensure stability.