Suricata CVE-2026-31934

Suricata versions 8.0.0 through 8.0.3 with SMTP protocol inspection enabled. Attacker sends crafted SMTP messages containing mime-encoded content with specially formatted URLs. Remote unauthenticated attacker can trigger quadratic complexity causing denial of service via performance degradation.

The CVSS base score of 7.5 (High) reflects network-based attack vector with low complexity and no authentication required (AV:N/AC:L/PR:N), but impact is limited to availability (A:H) with no confidentiality or integrity compromise. Real-world risk is moderate rather than critical. While unauthenticated remote exploitation is possible, successful attacks require sustained delivery of malicious SMTP traffic to the monitored network segment, and impact manifests as performance degradation rather than complete service failure or data breach. No public exploit identified at time of analysis, and the issue requires attackers to control or influence SMTP traffic flows being inspected by the Suricata sensor. Organizations using Suricata purely for passive network monitoring may experience delayed alerting during attacks, while inline IPS deployments could experience traffic processing delays. The narrow version range (8.0.0-8.0.3) limits exposure scope, as earlier stable branches and the latest 8.0.4 release are unaffected. Priority should be elevated for environments with high-volume SMTP inspection requirements or inline blocking configurations where performance degradation directly impacts mail delivery.

An attacker identifies a target network using Suricata 8.0.0-8.0.3 for SMTP traffic inspection, either through reconnaissance of the target's security infrastructure or by observing detection behavior patterns. The attacker then establishes an SMTP connection to the organization's mail server or relay (which is monitored by the Suricata sensor) and transmits messages containing specially crafted MIME-encoded content with numerous embedded URLs designed to trigger quadratic parsing complexity. As the Suricata engine attempts to extract and analyze URLs from these malformed messages, CPU utilization spikes on the IDS/IPS appliance, causing processing delays for all monitored traffic. Sustained transmission of such malicious SMTP messages could degrade the sensor's ability to inspect traffic in real-time, potentially allowing subsequent attacks through other protocols to evade detection during the performance degradation window, or in inline IPS deployments, causing legitimate email delivery delays that impact business operations.