EUVD-2026-83394Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach traffic monitored by Suricata sensor
-
DeliveryCraft one large FTP command chunk
-
ExploitExceed ftp.max-tx transaction limit
-
ExecutionTrigger quadratic reprocessing of tx list
-
PersistExhaust CPU, degrade packet processing
-
ImpactMonitoring blind spot / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Requires a Suricata 8.0.5 sensor actively inspecting FTP application-layer traffic (FTP parsing is enabled by default) on a network path the attacker can send FTP command data across. The attacker must generate one large chunk of FTP command data sufficient to exceed the configured app-layer.protocols.ftp.max-tx transaction limit. Limiting factors: the flaw exists ONLY in version 8.0.5 (a single point release), the sensor must be seeing/parsing FTP traffic, and impact is confined to availability/monitoring - no code execution or data exposure. No authentication or user interaction is required (PR:N/UI:N). |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a remote, unauthenticated attacker sends crafted FTP command data over the network that Suricata is monitoring, and the impact is pure denial of service (C:N/I:N) via CPU exhaustion (A:H) from quadratic reprocessing of an over-allocated transaction list - matching CWE-407 (Algorithmic Complexity). No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' The high CVSS is driven entirely by the A:H availability impact, not by any confidentiality/integrity risk, so this is a real DoS/monitoring-evasion concern rather than a system-compromise emergency. A notable mitigating signal absent from the raw score: the affected window is extremely narrow - only version 8.0.5 (introduced there, fixed in 8.0.6) - which sharply limits the exposed population. No data is missing or self-contradictory; the vector, description, and patch commits all agree. |
| Exploit ScenarioDerived | An attacker who can generate FTP traffic that traverses a Suricata sensor sends a single large chunk of FTP command data that pushes the transaction count past app-layer.protocols.ftp.max-tx. Because the FTP parser keeps allocating transactions past that limit, Suricata then repeatedly reprocesses the oversized list with quadratic complexity, spiking CPU and degrading or stalling packet processing. The practical goal is often to blind the IDS/IPS (reduced monitoring visibility) or to cause outright denial of service; no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Denial of service in Suricata 8.0.5 allows remote, unauthenticated attackers to degrade an IDS/IPS sensor's packet processing by sending crafted FTP command data. When a single large chunk of FTP commands exceeds the configured app-layer.protocols.ftp.max-tx limit, the FTP parser keeps allocating transactions and then repeatedly walks the oversized transaction list with quadratic cost, triggering the too_many_transactions event and driving CPU consumption that reduces monitoring visibility or stalls inspection entirely. Impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and is confined to the single 8.0.5 release; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
RemediationAI
Vendor-released patch: upgrade to Suricata 8.0.6 (https://github.com/OISF/suricata/releases/tag/suricata-8.0.6), which caps transaction allocation at app-layer.protocols.ftp.max-tx and error-states the offending flow; the fix is implemented by upstream commits 15bf91c5ccbbbf640cd042e1c96974b262549385 and 82c41905589305e8389ceb793907ccb74798aee5 and tracked in Redmine issue 8592, with details in advisory GHSA-w394-3g33-3jg9. If an immediate upgrade is not possible, the cleanest specific compensating control is to roll back to 8.0.4, since the vulnerable behavior exists only in the 8.0.5 point release - the trade-off is losing whatever other fixes 8.0.5 carried. Alternatively, disable FTP parsing entirely with app-layer.protocols.ftp.enabled: false (or equivalent selective disable) on sensors that do not need FTP coverage; the trade-off is the loss of all FTP-based signature detection, file extraction, and FTP transaction logging for that sensor. Lowering app-layer.protocols.ftp.max-tx is not a reliable mitigation here, because the vulnerable code continues allocating past the limit and merely reaches the too_many_transactions state sooner. Sensors deployed inline/IPS should be considered for temporary placement in IDS-only mode or have untrusted FTP command paths segmented away, since a CPU-stalled inline engine can drop or pass traffic while it catches up. Finally, alert on the protocol.too_many_transactions event and on Suricata engine-level capture/kernel drop statistics - elevated volume of that event alongside rising drop counters is the observable signature of exploitation attempts against an unpatched 8.0.5 sensor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect sits in Suricata's FTP application-layer parser (src/app-layer-ftp.c), part of the app-layer framework that reconstructs protocols like FTP from reassembled TCP streams so signature and anomaly detection can run against them. FTPTransactionCreate() allocates FTPTransaction objects into the FtpState transaction list; the vulnerable code failed to stop allocating when the per-flow transaction ceiling (app-layer.protocols.ftp.max-tx) was reached, so a single oversized chunk of FTP command data could blow past the limit. Once the protocol.too_many_transactions event fired, Suricata still iterated the now-oversized list repeatedly, producing the quadratic (O(n^2)) behavior classified as CWE-407, Inefficient Algorithmic Complexity - the root cause is an unbounded allocation combined with an O(n^2) processing loop rather than a memory-safety bug. The 8.0.6 fix makes FTPTransactionCreate() return NULL at the threshold, stops further allocation, and places the flow into an error state (as the updated suricata-yaml.rst documents) so Suricata refuses to keep paying CPU for a flow that is too expensive to process. FTP parsing is enabled by default in affected builds, and the assessed vector (PR:N/UI:N) means the attacker needs only the ability to deliver FTP command data along a path the sensor inspects - no credentials or user action.
Know when Suricata gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted FTP traffic (AV:N/AC:L/PR:N/UI:N) causes CPU-exhaustion DoS on the monitoring engine only (S:U), with no confidentiality or integrity impact (A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Technical POC Analysis
CWE-407 (Inefficient Algorithmic Complexity).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Suricata 8.0.5, an open-source intrusion detection and prevention system, is vulnerable to a remote, unauthenticated denial-of-service attack that can degrade or stall network monitoring. Organizations relying on this version may face reduced visibility into network threats, potentially delaying incident response and exposing critical assets. Although no public exploit identified at time of analysis, the availability-only impact and high severity warrant immediate attention from security leadership.
Disable FTP app-layer parsing (app-layer.protocols.ftp.enabled: no) in Suricata 8.0.5 configuration, restrict FTP traffic to trusted sources, monitor sensor CPU for anomalies, and consider reverting to a prior stable release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vul
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
Exploit-DB