Suricata EUVD-2026-75789

IKE application-layer parsing must be enabled in Suricata's configuration (suricata.yaml); this is the default behavior in standard deployments, so no special non-default configuration is required on the victim side. The attacker must be able to send crafted UDP packets toward a network interface monitored by the vulnerable Suricata instance - either directly if Suricata monitors internet-facing traffic, or from within an adjacent network segment. No authentication, session state, or prior handshake is required; the unbounded allocation occurs during parsing of attacker-controlled IKEv2 payloads. Exploitation is limited to availability impact only - there is no path to code execution or data exfiltration via this vulnerability.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and accurately reflects the attack surface: the vulnerability is reachable over the network, requires no authentication, imposes no special conditions on the attacker, and produces a high-availability impact. There is no confidentiality or integrity component. No KEV listing exists, meaning active exploitation has not been confirmed by CISA. No public exploit code has been identified at time of analysis. EPSS data was not provided, so exploitation probability cannot be quantified precisely. Despite the absence of known exploitation, the practical risk is elevated for deployments running Suricata in inline IPS mode: a successful DoS here does not merely degrade monitoring - it blinds the security enforcement layer entirely. Organizations using Suricata as a perimeter IPS or for critical network visibility should treat this as a high-priority patch, particularly since the attack requires only the ability to send UDP packets toward the sensor, which may be trivially achievable from the internet or an untrusted segment.

An attacker positioned anywhere on a network path to the Suricata sensor - including from the internet if the sensor monitors internet-facing traffic - sends a continuous stream of crafted IKEv2 UDP packets with inflated or repeatedly extended transform lists. Each packet causes the IKEv2 parser to allocate additional state, and since no limit is enforced, memory consumption grows until the Suricata process is killed by the OS OOM killer or becomes unresponsive, disabling intrusion detection and prevention for all monitored traffic.