EUVD-2026-75762Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Suricata sensor monitoring DNP3 segment
-
DeliveryCraft malformed DNP3 packets maximizing fragment accumulation
-
ExploitTransmit sustained stream at sensor
-
ExecutionTrigger unbounded reassembly buffer growth
-
PersistExhaust sensor process memory
-
ImpactSensor crashes, network visibility lost
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | DNP3 protocol inspection must be explicitly enabled in Suricata's configuration - it is not active in default installations. Exploitation requires the attacker to be able to send or inject DNP3 protocol traffic (TCP port 20000 by default) into a network segment that Suricata is monitoring. Additionally, if stream.reassembly.depth is set to a non-zero finite value, exploitation is limited or prevented. Factors limiting exploitation: non-default feature flag (DNP3 disabled by default), typically only deployed in OT/ICS network environments, no authentication bypass or code execution - impact is availability-only (process memory exhaustion/crash). |
| Impact | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures the network-reachable, unauthenticated DoS impact, but treats AC as Low, which overstates accessibility. DNP3 is not enabled by default in Suricata; an attacker requires the target deployment to have explicitly activated DNP3 inspection, which is a condition beyond attacker control - this argues for AC:H in practice. EPSS data is not provided; given the narrow deployment context (OT-adjacent Suricata sensors) and absence of KEV listing or public PoC, real-world exploitation probability is assessed as low-to-moderate. The impact on a running Suricata IDS/IPS is significant: process crash or OOM kill on the sensor would blind the network security stack, making this a meaningful operational risk for ICS-adjacent environments where Suricata is positioned inline (IPS mode). Workarounds are effective and well-documented. No KEV listing or public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker with access to a network segment monitored by a Suricata sensor that has DNP3 inspection enabled sends a continuous stream of crafted DNP3 packets designed to maximize reassembly buffer growth without completing a valid application-layer transaction. The Suricata process consumes memory unboundedly until the OS OOM killer terminates it or the host swaps to exhaustion, leaving the monitored network segment without IDS/IPS coverage. In an IPS deployment, this could also remove inline blocking capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Suricata 7.0.16 (stable branch) or 8.0.5 (current branch) as documented in the release announcement at https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315. For operators who cannot immediately upgrade, two effective workarounds exist: first, if DNP3 monitoring is not operationally required, disable the DNP3 protocol detection in suricata.yaml - DNP3 is off by default and disabling it entirely eliminates the attack surface with no impact on non-ICS deployments. Second, set stream.reassembly.depth to a finite, operationally appropriate value (e.g., 65535 bytes) to bound memory consumption; note that a value of 0 or omitting the setting means unlimited depth. The trade-off of capping reassembly depth is that very large DNP3 sessions may not be fully inspected, potentially creating a detection gap for payloads spanning deep into the stream.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Suricata (cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*) is an open-source network security engine developed by the Open Information Security Foundation (OISF) that supports IDS, IPS, and NSM modes. DNP3 (Distributed Network Protocol 3) is a layer-7 industrial control system protocol used in SCADA and OT environments (power, water, oil/gas). Suricata implements DNP3 stream reassembly to inspect multi-packet DNP3 sessions. CWE-400 (Uncontrolled Resource Consumption) is the root cause: the reassembly engine buffers incoming DNP3 fragments without an adequate upper-bound check on accumulated data volume, permitting adversarially crafted traffic to drive memory consumption to levels that degrade or crash the sensor process. The stream.reassembly.depth configuration parameter, when set to 0 or absent, imposes no limit.
Know when Suricata gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
DNP3 must be explicitly enabled (non-default), making successful attack contingent on a condition beyond attacker control, warranting AC:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited stream.reassembly.depth (0 or absent is unlimited).
Technical POC Analysis
The bug class is uncontrolled resource consumption (CWE-400, per the CVE); the advisory additionally assigns CWE-770 (allocation of resources without limits or throttling).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Suricata network monitoring systems with DNP3 parsing enabled are vulnerable to a denial-of-service attack in which unauthenticated remote attackers send crafted DNP3 traffic to cause memory exhaustion and disable security monitoring capabilities. This vulnerability primarily affects organizations operating industrial control system and operational technology network monitoring, where Suricata provides critical security visibility. Since DNP3 parsing is not enabled by default, exposure is limited to deployments explicitly configured to monitor DNP3 traffic.
Apply vendor patch. If patch deployment is delayed beyond 7 days, implement network-level access controls restricting DNP3 traffic to trusted sources only and disable DNP3 parsing if not actively required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vul
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB