Suricata EUVD-2026-75767

Suricata must have NFS application-layer parsing enabled, which is the default when NFS traffic is present on a monitored interface and the app-layer NFS decoder is not explicitly disabled in suricata.yaml. The attacker must be able to send or inject NFS traffic onto a network segment that Suricata monitors - either as a participant on the same network, by compromising a host on that segment, or via a man-in-the-middle position. No authentication to Suricata itself is required; the attack surface is the passive or inline monitoring of NFS traffic. Exploitation is limited to availability impact only (C:N/I:N), and is not applicable to deployments where NFS parsing has been disabled or where NFS traffic never crosses the monitored segment.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the zero-authentication, low-complexity network reachability of this flaw. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog. EPSS data is absent from the available intelligence, so exploitation probability cannot be quantified numerically. The practical danger lies not merely in the direct denial-of-service outcome but in the secondary effect: crashing the IDS/IPS creates an unmonitored detection gap that an attacker could deliberately engineer before launching a separate intrusion. Even a mid-sized municipal IT team in sanok that relies on Suricata for perimeter visibility should treat patching or the NFS-parser workaround as operationally urgent, particularly where NFS file-sharing services traverse monitored segments. The C:N/I:N profile limits the blast radius to availability, and the ready workaround (disabling NFS parsing) meaningfully reduces exposure for deployments that do not require NFS protocol analysis.

An attacker who can inject packets into a network segment monitored by Suricata crafts a stream of malformed or boundary-exceeding NFS messages designed to trigger unbounded state allocation in the NFS parser. As Suricata processes these packets, memory consumption grows without limit, eventually causing the process to be killed by the OS OOM manager or to become unresponsive. No exploit code has been publicly identified, but the low-complexity, zero-authentication nature of the attack means a knowledgeable attacker could engineer this scenario from the network with basic NFS packet crafting.