Suricata EUVD-2026-83398

Exploitation requires the attacker's traffic to traverse a network segment monitored by a vulnerable Suricata (prior to 7.0.17 / 8.0.6), and requires crafting an IPv4/IPv6 flow pair whose raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket all align so the family-blind comparator in flow-hash.c treats them as the same flow. Realistic limits: the collision demands attacker knowledge/control of these hashing inputs to line up an opposite-family flow (reflected in AC:H), so it is targeted rather than opportunistic; impact is confined to defeating Suricata's own detection/flowbit/IP-only logic (no host confidentiality or availability loss). Detection sensors that inspect only IPv4 or only IPv6 traffic, or deployments where the two families cannot be made to share hashing inputs, are not realistically affected.

This is a genuine but specialized detection-integrity flaw in a widely-used open-source IDS/IPS, not a broad compromise vector. The CVSS 5.9 (medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N is well-reasoned: unauthenticated and network-reachable (traffic-driven), but AC:H reflects that an attacker must engineer an IPv4/IPv6 pair whose raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket all align to force the flow-hash collision - a non-trivial precondition confirmed by the src/flow-hash.c source diff. Impact is C:N/I:H/A:N: no data confidentiality or availability loss, but the integrity of the security monitoring engine's own decisions is undermined (incorrect flowbit state, detection bypass, IP-only rule bypass). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so this is no public exploit identified at time of analysis - a defense-weakening bug rather than a mass-exploited RCE. The 'Authentication Bypass' tag conflicts with the actual CWE-697 (incorrect comparison) nature of the flaw and should be treated as a mislabel: nothing here bypasses authentication; it bypasses detection.

An attacker whose traffic transits a monitored Suricata segment crafts IPv6 (or IPv4) packets whose 5-tuple and hashing inputs collide with an existing opposite-family flow, causing the malicious flow to inherit the benign flow's state and evade flowbit-based or IP-only detection rules. Malicious content in the colliding flow then passes without alerting, or an IP-only block is sidestepped. No public exploit code is identified at time of analysis, and the high attack complexity means crafting a reliable collision requires knowledge of the target's flow-hashing inputs.