EUVD-2026-83384Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-delivered SIP but AC:H (needs >65,536-byte body and frame-based SIP rules); no privileges; only partial loss of monitoring integrity (I:L), no C or A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.
AnalysisAI
SIP body-length truncation in Suricata 8.0.0 through 8.0.5 causes the IDS/IPS engine to expose only the first 65,536 bytes of oversized SIP request or response bodies to frame-based inspection, letting an unauthenticated remote attacker hide malicious content in the omitted remainder and evade detection. The flaw resides in the Rust SIP parser, which stores body offsets and lengths in 16-bit fields, so any body larger than 65,536 bytes wraps the stored length; this only matters on deployments that enable SIP application-layer parsing and run rules referencing frame:request.body or frame:response.body, and it degrades detection integrity only (no crash, no code execution, no data exposure). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the monitored network carries SIP traffic AND that Suricata is configured with SIP application-layer parsing plus frame-based detection rules referencing frame:request.body or frame:response.body; without such rules there is nothing to evade. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity detection-integrity flaw, not a system-compromise vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Suricata 8.0.6, which widens the SIP parser's length and offset fields from 16-bit to 32-bit and restores full-body visibility for frame:request.body and frame:response.body (vendor-released patch: 8.0.6; see https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 and the advisory at https://github.com/OISF/suricata/security/advisories/GHSA-prqx-q74v-wxhv). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Ra
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today