Suricata CVE-2026-63446

Exploitation requires the affected Suricata sensor (8.0.0-8.0.5) to be running a configuration where matching flows are handled by a 'pass' rule or by a 'pass-the-flow' exception policy - this is the exact trigger named in the description. On such flows detection is skipped, so completed application-layer transactions are never marked inspected or freed and are repeatedly rescanned. The limiting factor is this non-default detection configuration: deployments that do not use pass rules or pass-the-flow exception policies are not affected. No authentication or user interaction is needed to reach the affected flows (PR:N/UI:N); the attacker only needs to sustain application-layer traffic on a pass-handled flow.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly models this as a pure availability impact: a memory-leak/CPU-exhaustion denial-of-service (CWE-401) with no confidentiality or integrity effect (C:N/I:N). No EPSS score, CISA KEV entry, or public POC/exploit was provided, so exploitation status is 'no public exploit identified at time of analysis.' The high base score is driven entirely by A:H combined with network reach and no authentication, but real-world risk is materially reduced by a crucial precondition the base vector does not capture: the flaw only triggers on flows handled by a 'pass' rule or a 'pass-the-flow' exception policy, i.e. a non-default detection configuration. The input Tag 'Information Disclosure' conflicts with the description and CVSS vector (C:N) - this is a resource-exhaustion DoS, not disclosure; treat the tag as mislabeled. Overall this is a legitimate availability priority for organizations that use pass rules/pass-the-flow policies, but not a widespread mass-exploitation issue: it degrades the monitoring sensor itself rather than a downstream asset, and requires that specific ruleset configuration to be reachable.

An attacker (or even benign traffic) generates many application-layer transactions on a flow that matches a Suricata 'pass' rule or pass-the-flow exception policy; because detection is skipped, completed transactions are never marked inspected and never freed. The per-flow transaction list grows without bound with quadratic cleanup cost, driving CPU and memory exhaustion until the Suricata sensor degrades or crashes. No public exploit code was identified; the condition can be reached simply by sustaining traffic on an affected pass-handled flow.