Suricata EUVD-2026-18239

Suricata IDS/IPS/NSM versions prior to 7.0.15 or 8.0.4 with KRB5 protocol inspection enabled. Remote attacker sends specially crafted Kerberos traffic to degrade performance. No authentication or user interaction required; affects default monitoring configurations processing KRB5 traffic.

Real-world risk is moderate despite the CVSS 7.5 rating. The CVSS vector shows network-accessible attack surface (AV:N) with low complexity (AC:L) and no authentication required (PR:N), making this easily exploitable. However, the impact is limited to availability (A:H) with no confidentiality or integrity compromise. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not yet widely exploited. The primary concern is for organizations using Suricata as their primary IDS/IPS where performance degradation could create blind spots in security monitoring or cause legitimate traffic drops in IPS mode. The vulnerability is particularly concerning in high-volume environments with significant Kerberos authentication traffic, such as Active Directory-heavy enterprise networks. While the SSVC framework would rate technical impact as partial (availability only), the automatable nature (no user interaction required per UI:N) elevates priority for environments dependent on Suricata for security visibility. Organizations not actively monitoring Kerberos traffic or using Suricata in passive IDS-only mode face lower practical risk.

An attacker identifies a target network using Suricata for intrusion detection or prevention. By crafting or replaying Kerberos 5 authentication traffic with characteristics that trigger inefficient buffering, the attacker floods the network segment monitored by Suricata. The KRB5 parser consumes excessive CPU and memory resources processing these packets, degrading Suricata's overall performance. As packet processing slows, the IDS begins dropping packets and missing alerts, creating blind spots in security monitoring. In IPS deployment mode, legitimate traffic may be delayed or dropped as well, causing service disruptions. The attacker then launches secondary attacks during this degraded state, knowing the IDS/IPS cannot effectively detect or block malicious activity. This technique is particularly effective in enterprise environments where Kerberos authentication generates continuous baseline traffic that can mask malicious packet patterns.