ANT-2026-DVZKVAV1 · oisf/suricata

use-after-free medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-DVZKVAV1: Heap use-after-free write in YAML configuration include processing due to stale pointer to freed node after redef

A stale pointer to a freed YAML node is written through during configuration include processing after the node is redefined.

Target

Project: suricata

Technical Details

During YAML configuration include processing, a redefinition frees a node while a stale pointer to that node is retained and later written through, resulting in a heap use-after-free write.

Crash signature: Heap use-after-free WRITE in YAML include processing

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-DVZKVAV1.

Reference: ANT-2026-DVZKVAV1
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits. The writeup below is the document the firm sent to the maintainer.

Verdict: true positive
Severity: medium

config: use after free when include sequence redefines parent of dotted key

For example, a @suricata.yaml@ that loos like:

%YAML 1.1
---
outputs.x: val
include:
  - ./include.yaml

and @include.yaml@:

%YAML 1.1
---
outputs: []

The override cleaned up after itself, but the node is still marked a sequence.

Reported by: Trail of Bits, in collaboration with Anthropic

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-04-09 Sent to maintainer
2026-04-13 Patch released
2026-05-07 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

f654fc23ea7b285a9a9a861a1d25c0653c0dc7b8961efc23dd5817ba47a1aa73e6a26b1518cb1903eb30eadeb92286c6e27d40f82422a88a9cde29e9acd9e268

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 13:03 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-DVZKVAV1",
  "bug_class": "Use-After-Free",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:27+00:00",
  "description": "A stale pointer to a freed YAML node is written through during configuration include processing after the node is redefined.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Suricata",
  "reproduction": null,
  "technical_details": "During YAML configuration include processing, a redefinition frees a node while a stale pointer to that node is retained and later written through, resulting in a heap use-after-free write.",
  "title": "Heap use-after-free write in YAML configuration include processing due to stale pointer to freed node after redef",
  "vendor_severity": "medium"
}