EUVD-2026-83393Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker-observed network traffic triggers it (AV:N/PR:N/UI:N), but the one-directional/async-oneside visibility precondition raises complexity (AC:H); availability-only resource exhaustion on the sensor, no C/I impact (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
AnalysisAI
Denial of service in the Suricata SMB parser lets remote attackers exhaust sensor CPU and memory by driving sustained one-directional SMB traffic through an affected sensor. Suricata versions prior to 7.0.17 and 8.0.6 retain force-completed transactions on flows where payload is seen in only one direction (including async-oneside flows), because cleanup waits for inspection in the direction that never arrives; transaction creation paths can then exceed the intended SMB_MAX_TX bound while cleanup repeatedly rescans the growing list, producing unbounded per-flow state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a Suricata sensor (prior to 7.0.17 or 8.0.6) is inspecting SMB traffic AND sees payload in only one direction of the flow - e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority denial-of-service issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Suricata 7.0.17 or 8.0.6 - vendor-released patches issued as releases tagged suricata-7.0.17 and suricata-8.0.6 - and confirm the fixes are present by verifying the SMB transaction code returns Option instead of unwrapping the back of the transaction list; see advisory GHSA-hvvj-c8xx-9g35 and https://redmine.openinfosecfoundation.org/issues/8629 for the authoritative change set. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Ra
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today