Oisf
Monthly
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.
Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.
Network denial-of-service in Suricata prior to 7.0.15 allows remote unauthenticated attackers to degrade intrusion detection performance via inefficient DCERPC buffering. The flaw enables attackers to bypass or impair network security monitoring by exhausting system resources through malformed DCERPC traffic, effectively blinding detection capabilities. No public exploit identified at time of analysis, though EPSS score and exploitation likelihood were not provided in available data.
Memory exhaustion in Suricata network IDS/IPS via HTTP/2 CONTINUATION frame flooding allows remote unauthenticated attackers to trigger denial of service, typically forcing operating system termination of the Suricata process. Affects all versions prior to 7.0.15 and 8.0.4. EPSS data not available, but CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no privileges. No public exploit identified at time of analysis, though the attack technique (HTTP/2 frame flooding) is well-documented in protocol security research.
Denial of service in Suricata 8.0.0 through 8.0.3 allows unauthenticated remote attackers to degrade performance via specially crafted SMTP traffic containing MIME-encoded messages with URLs. The quadratic complexity vulnerability (CWE-407) triggers excessive processing when the IDS/IPS engine searches for URLs in malformed messages. EPSS data not provided, but exploitation probability appears low given no public exploit identified at time of analysis and the requirement for sustained malicious SMTP traffic to achieve impact.
Network-accessible resource exhaustion in Suricata IDS allows remote attackers to degrade detection performance via specially crafted traffic. Affects versions prior to 7.0.15 and 8.0.4 (CVSS 7.5 HIGH). Attack requires no authentication (PR:N) and low complexity (AC:L), enabling trivial performance degradation that could blind security monitoring. EPSS data not available, but no public exploit identified at time of analysis. Vendor patches released for both affected branches (7.0.15, 8.0.4).
Performance degradation in Suricata IDS/IPS engine allows remote unauthenticated attackers to cause denial of service through inefficient Kerberos 5 buffering. Affects versions prior to 7.0.15 and 8.0.4. CVSS 7.5 with high availability impact. No public exploit identified at time of analysis, EPSS data not provided. Vendor-released patches available in versions 7.0.15 and 8.0.4.
NULL pointer dereference in Suricata 8.0.0 through 8.0.3 causes denial of service when processing malformed TLS traffic with the 'tls.alpn' rule keyword. Remote unauthenticated attackers can crash the IDS/IPS engine by sending specially crafted network packets, completely disabling network security monitoring. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with high availability impact (A:H) indicate significant operational risk for organizations relying on Suricata for traffic inspection. No evidence of active exploitation (no CISA KEV listing) or public exploit code identified at time of analysis.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
Suricata versions 8.0.0 through 8.0.2 are susceptible to a stack overflow crash when processing network traffic with improperly configured body size limits. An unauthenticated remote attacker can trigger a denial of service by sending crafted requests that exceed the application's stack capacity. A patch is available in version 8.0.3, or administrators can apply the workaround of using default values for request-body-limit and response-body-limit configurations.
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.
Uncontrolled buffer expansion in Suricata's DCERPC parser allows remote attackers to trigger unbounded memory allocation and cause denial of service by sending specially crafted DCERPC traffic. The vulnerability affects versions prior to 8.0.3 and 7.0.14 across DCERPC/UDP, DCERPC/TCP, and SMB protocols, with TCP being partially protected by default stream depth limits. Patches are available, and administrators can mitigate by disabling vulnerable parsers or configuring stream reassembly depth limits.
Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.
Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.
Use-after-free in Suricata's inspection-buffer helper crashes the IDS/IPS engine, yielding a network-exploitable denial-of-service against any deployment running rules that chain the `dotprefix` transform after another transform. Affected versions prior to 7.0.16 (stable) and 8.0.5 include all prior 7.x and 8.x releases. No public exploit code and no CISA KEV listing have been identified; exploitation requires an attacker to know or guess that the target's ruleset matches the vulnerable pattern, and then craft traffic to trigger the reallocation path.
Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a stack buffer overflow when processing oversized datasets with the save or state options enabled, allowing an attacker with network access to cause a denial of service. The vulnerability requires specific conditions to trigger but does not require authentication or user interaction. A patch is available in the latest versions.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
A security vulnerability in Suricata (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
LibHTP is a security-aware parser for the HTTP protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.
Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.
Network denial-of-service in Suricata prior to 7.0.15 allows remote unauthenticated attackers to degrade intrusion detection performance via inefficient DCERPC buffering. The flaw enables attackers to bypass or impair network security monitoring by exhausting system resources through malformed DCERPC traffic, effectively blinding detection capabilities. No public exploit identified at time of analysis, though EPSS score and exploitation likelihood were not provided in available data.
Memory exhaustion in Suricata network IDS/IPS via HTTP/2 CONTINUATION frame flooding allows remote unauthenticated attackers to trigger denial of service, typically forcing operating system termination of the Suricata process. Affects all versions prior to 7.0.15 and 8.0.4. EPSS data not available, but CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no privileges. No public exploit identified at time of analysis, though the attack technique (HTTP/2 frame flooding) is well-documented in protocol security research.
Denial of service in Suricata 8.0.0 through 8.0.3 allows unauthenticated remote attackers to degrade performance via specially crafted SMTP traffic containing MIME-encoded messages with URLs. The quadratic complexity vulnerability (CWE-407) triggers excessive processing when the IDS/IPS engine searches for URLs in malformed messages. EPSS data not provided, but exploitation probability appears low given no public exploit identified at time of analysis and the requirement for sustained malicious SMTP traffic to achieve impact.
Network-accessible resource exhaustion in Suricata IDS allows remote attackers to degrade detection performance via specially crafted traffic. Affects versions prior to 7.0.15 and 8.0.4 (CVSS 7.5 HIGH). Attack requires no authentication (PR:N) and low complexity (AC:L), enabling trivial performance degradation that could blind security monitoring. EPSS data not available, but no public exploit identified at time of analysis. Vendor patches released for both affected branches (7.0.15, 8.0.4).
Performance degradation in Suricata IDS/IPS engine allows remote unauthenticated attackers to cause denial of service through inefficient Kerberos 5 buffering. Affects versions prior to 7.0.15 and 8.0.4. CVSS 7.5 with high availability impact. No public exploit identified at time of analysis, EPSS data not provided. Vendor-released patches available in versions 7.0.15 and 8.0.4.
NULL pointer dereference in Suricata 8.0.0 through 8.0.3 causes denial of service when processing malformed TLS traffic with the 'tls.alpn' rule keyword. Remote unauthenticated attackers can crash the IDS/IPS engine by sending specially crafted network packets, completely disabling network security monitoring. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with high availability impact (A:H) indicate significant operational risk for organizations relying on Suricata for traffic inspection. No evidence of active exploitation (no CISA KEV listing) or public exploit code identified at time of analysis.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
Suricata versions 8.0.0 through 8.0.2 are susceptible to a stack overflow crash when processing network traffic with improperly configured body size limits. An unauthenticated remote attacker can trigger a denial of service by sending crafted requests that exceed the application's stack capacity. A patch is available in version 8.0.3, or administrators can apply the workaround of using default values for request-body-limit and response-body-limit configurations.
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.
Uncontrolled buffer expansion in Suricata's DCERPC parser allows remote attackers to trigger unbounded memory allocation and cause denial of service by sending specially crafted DCERPC traffic. The vulnerability affects versions prior to 8.0.3 and 7.0.14 across DCERPC/UDP, DCERPC/TCP, and SMB protocols, with TCP being partially protected by default stream depth limits. Patches are available, and administrators can mitigate by disabling vulnerable parsers or configuring stream reassembly depth limits.
Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.
Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.
Use-after-free in Suricata's inspection-buffer helper crashes the IDS/IPS engine, yielding a network-exploitable denial-of-service against any deployment running rules that chain the `dotprefix` transform after another transform. Affected versions prior to 7.0.16 (stable) and 8.0.5 include all prior 7.x and 8.x releases. No public exploit code and no CISA KEV listing have been identified; exploitation requires an attacker to know or guess that the target's ruleset matches the vulnerable pattern, and then craft traffic to trigger the reallocation path.
Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a stack buffer overflow when processing oversized datasets with the save or state options enabled, allowing an attacker with network access to cause a denial of service. The vulnerability requires specific conditions to trigger but does not require authentication or user interaction. A patch is available in the latest versions.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
A security vulnerability in Suricata (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
LibHTP is a security-aware parser for the HTTP protocol. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.