Suricata CVE-2026-63450

Requires that Suricata is deployed with FTP application-layer inspection active (default) and positioned to observe an FTP control channel the attacker can influence. The attacker must be able to inject an out-of-order FTP command sequence - issuing RETR or STOR before PORT/PASV negotiation on the monitored flow - which is the exact trigger (hence AC:H). Impact is limited to the monitoring plane: in IDS mode it creates a rule/logging blind spot for the remainder of that TCP flow; in IPS mode the effect is a dropped flow (fail-closed), so no target host is compromised and no confidentiality is lost. Not exploitable against hosts that do not carry FTP through a Suricata sensor, and versions 8.0.6 and later are unaffected.

This is a genuinely low-priority defect, and the signals agree. Vendor CVSS is 3.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable but high attack complexity (a specific out-of-sequence FTP command ordering must be induced on a monitored flow) and only a limited integrity impact (C:N, A:N). CWE-755 (improper handling of exceptional conditions) matches the description precisely: a RETR/STOR issued before PORT/PASV is treated as a fatal application-layer error, poisoning FTP parsing for the rest of the TCP flow. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so exploitation status is 'no public exploit identified.' The real-world impact is defensive-tooling degradation rather than compromise of a target host: in IDS/IDS-monitoring mode later FTP commands evade parser-dependent rules and logging (a monitoring blind spot / detection evasion), while in IPS mode the flow is dropped (fail-closed, so no security loss). No signals conflict; the only metadata problem is the 'Information Disclosure' tag, which does not match the actual detection-evasion / exception-handling nature of the flaw (the vector explicitly sets C:N).

An attacker whose FTP traffic transits a Suricata-monitored segment opens an FTP control connection and sends a RETR or STOR command before any PORT/PASV negotiation. This drives the FTP parser into a fatal state that disables FTP application-layer parsing for the remainder of the flow, so the attacker's subsequent FTP activity (e.g. file transfers) proceeds without triggering parser-dependent rules or being logged. No public exploit code is known, and the specific command ordering plus reliance on FTP inspection makes this AC:H.