Suricata
Monthly
Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.
Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
Denial of service in Suricata versions 8.0.0 through 8.0.5 allows unauthenticated remote attackers to exhaust sensor CPU and degrade packet-processing throughput by sending crafted DNS-over-HTTP/2 traffic. The HTTP/2 DoH parser retains previously processed DATA frame contents instead of clearing its internal buffer, so a series of DATA frames with the EndOfStream flag set repeatedly reprocesses old data while the buffer grows toward its 65 KiB limit, yielding quadratic CPU cost and potential loss of network monitoring visibility. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patch 8.0.6 closes the issue.
Remote, unauthenticated attackers can exhaust CPU and memory on Suricata 8.0.0 through 8.0.5 sensors by sustaining application-layer traffic on flows that are handled by a pass rule or a pass-the-flow exception policy, degrading the IDS/IPS to a denial-of-service condition. The defect is an inverted guard in AppLayerParserSetTransactionInspectId() that marks only already-inspected transactions as inspected, so on those pass-handled flows detection is skipped and completed transactions are never marked or freed, accumulating in the per-flow list and being rescanned with quadratic cleanup cost. Only availability is affected (C:N/I:N/A:H); the issue is fixed in Suricata 8.0.6, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in Suricata 8.0.5 allows remote, unauthenticated attackers to degrade an IDS/IPS sensor's packet processing by sending crafted FTP command data. When a single large chunk of FTP commands exceeds the configured app-layer.protocols.ftp.max-tx limit, the FTP parser keeps allocating transactions and then repeatedly walks the oversized transaction list with quadratic cost, triggering the too_many_transactions event and driving CPU consumption that reduces monitoring visibility or stalls inspection entirely. Impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and is confined to the single 8.0.5 release; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Suricata 8.0.0 through 8.0.5 can be degraded into a denial-of-service condition by a remote, unauthenticated attacker who streams repeated small brotli-compressed HTTP/1 responses through a single inspected flow. The HTTP/1 parser caps the decompression work done per transaction but does not cap how many compression bombs a flow may submit, so each transaction forces the Rust htp decompression path to burn CPU until packet processing slows and monitoring visibility is lost; availability-only impact, with no confidentiality or integrity effect (CVSS base 7.5, CWE-400). Exploitation is gated on the non-default response-body-decompress-layer-limit setting being enabled and on the sensor seeing attacker-influenced traffic, and no public exploit or in-the-wild activity is identified at time of analysis; the vendor fixed the issue in Suricata 8.0.6.
Deadlock in the Linux kernel IP defragmentation subsystem occurs when processing fragmented encapsulated (tunneled) traffic, allowing a remote attacker to trigger a kernel locking deadlock by sending specially crafted fragmented tunnel packets. Any Linux system with active tunnel interfaces (GRE, IPIP, VXLAN, or similar encapsulation) and IP defragmentation enabled is potentially affected. The result is a denial-of-service condition causing the affected network path or system to hang, with no confidentiality or integrity impact identified. No public exploit or active exploitation has been identified at time of analysis.
An out-of-bounds read in Suricata's MIME quoted-printable decoder affects versions 7.0.13 through 7.0.16 and lets remote, unauthenticated attackers crash a sensor that inspects crafted MIME-bearing traffic, most plausibly SMTP email. Because Suricata parses passively, no credentials or user interaction are required, but exploitation only matters where MIME/SMTP app-layer inspection is actually running on an attacker-reachable path; the realistic outcome is a denial-of-service sensor crash, with only limited potential for exposing adjacent memory (the assessed Confidentiality impact is Low, not High). Patch status: Vendor-released patch - Suricata 7.0.17; EPSS is low (0.56%, 46th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis.
Unquoted LocalSystem service ImagePath in a Windows component distributed by Ubuntu/Canonical enables local privilege escalation to SYSTEM. When a Windows service ImagePath contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the binary by trying each path segment prefix in order - allowing a lower-privileged local attacker who can write to an intermediate directory to place a malicious executable that runs under LocalSystem context on next service start or system reboot. No patch version, CVSS score, or CWE has been assigned in the input data; no public exploit or KEV listing is present at time of analysis.
Resource exhaustion in an MQTT implementation tracked by Ubuntu allows an attacker to submit an unbounded number of messages within a single transaction, likely leading to memory or CPU exhaustion and denial of service. The affected component, version range, and exact package have not been confirmed from the available data - only Ubuntu's vendor tracking is present. No CVSS score, CWE, EPSS, KEV listing, or patch information was provided, making a full risk assessment impossible at this time.
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Denial of service in Suricata IDS/IPS/NSM engine (versions prior to 7.0.16 and 8.0.5) allows an unauthenticated remote attacker to exhaust CPU resources by sending HTTP responses containing crafted oversized `Content-Disposition` headers, causing the inspection engine to perform repeated expensive parsing iterations without bounds. The attack requires no privileges and exploits the security tooling itself - disabling Suricata's inspection capability - which can serve as a precursor to attacks that would otherwise be detected. No public exploit code and no CISA KEV listing have been identified, but the OISF has released patched versions and a rule-based workaround.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
A use-after-free in Suricata's inspection-buffer helper can crash or destabilize the detection engine (availability impact only) when a ruleset chains the `dotprefix` transform after another transform on the same inspection buffer, causing the backing buffer to be reallocated while a stale inspection pointer is retained. Affected deployments are Suricata before 7.0.16 and 8.0.x before 8.0.5; the flaw is remotely reachable (CVSS AV:N, PR:N, no user interaction) but exploitation is gated by a non-default, defender-controlled rule configuration plus traffic that traverses that specific inspection path, which is why our assessment raises the attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's base score of 7.5. No public exploit code has been identified at time of analysis, there is no CISA KEV listing (SSVC exploitation: none, automatable: no), and EPSS is low at 0.51% (42nd percentile). Vendor-released fixes are available in 7.0.16 and 8.0.5.
NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.
Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.
Local privilege escalation in the openSUSE Tumbleweed packaging of Suricata allows the unprivileged 'suricata' service account to gain root through a symbolic-link following flaw (CWE-61) in files or directories the package manages with predictable, service-writable paths. Any actor already holding the suricata user context - for example via a compromised or misconfigured IDS/IPS process - can plant a symlink that redirects a root-executed operation to a target of their choosing, yielding full system compromise. The CVSS 4.0 exploit-maturity metric is set to Proof-of-Concept (E:P); there is no evidence of active exploitation in CISA KEV, and no public exploit identified at time of analysis.
Network denial-of-service in Suricata prior to 7.0.15 allows remote unauthenticated attackers to degrade intrusion detection performance via inefficient DCERPC buffering. The flaw enables attackers to bypass or impair network security monitoring by exhausting system resources through malformed DCERPC traffic, effectively blinding detection capabilities. No public exploit identified at time of analysis, though EPSS score and exploitation likelihood were not provided in available data.
Memory exhaustion in Suricata network IDS/IPS via HTTP/2 CONTINUATION frame flooding allows remote unauthenticated attackers to trigger denial of service, typically forcing operating system termination of the Suricata process. Affects all versions prior to 7.0.15 and 8.0.4. EPSS data not available, but CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no privileges. No public exploit identified at time of analysis, though the attack technique (HTTP/2 frame flooding) is well-documented in protocol security research.
Denial of service in Suricata 8.0.0 through 8.0.3 allows unauthenticated remote attackers to degrade performance via specially crafted SMTP traffic containing MIME-encoded messages with URLs. The quadratic complexity vulnerability (CWE-407) triggers excessive processing when the IDS/IPS engine searches for URLs in malformed messages. EPSS data not provided, but exploitation probability appears low given no public exploit identified at time of analysis and the requirement for sustained malicious SMTP traffic to achieve impact.
Network-accessible resource exhaustion in Suricata IDS allows remote attackers to degrade detection performance via specially crafted traffic. Affects versions prior to 7.0.15 and 8.0.4 (CVSS 7.5 HIGH). Attack requires no authentication (PR:N) and low complexity (AC:L), enabling trivial performance degradation that could blind security monitoring. EPSS data not available, but no public exploit identified at time of analysis. Vendor patches released for both affected branches (7.0.15, 8.0.4).
Performance degradation in Suricata IDS/IPS engine allows remote unauthenticated attackers to cause denial of service through inefficient Kerberos 5 buffering. Affects versions prior to 7.0.15 and 8.0.4. CVSS 7.5 with high availability impact. No public exploit identified at time of analysis, EPSS data not provided. Vendor-released patches available in versions 7.0.15 and 8.0.4.
NULL pointer dereference in Suricata 8.0.0 through 8.0.3 causes denial of service when processing malformed TLS traffic with the 'tls.alpn' rule keyword. Remote unauthenticated attackers can crash the IDS/IPS engine by sending specially crafted network packets, completely disabling network security monitoring. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with high availability impact (A:H) indicate significant operational risk for organizations relying on Suricata for traffic inspection. No evidence of active exploitation (no CISA KEV listing) or public exploit code identified at time of analysis.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
Suricata versions 8.0.0 through 8.0.2 are susceptible to a stack overflow crash when processing network traffic with improperly configured body size limits. An unauthenticated remote attacker can trigger a denial of service by sending crafted requests that exceed the application's stack capacity. A patch is available in version 8.0.3, or administrators can apply the workaround of using default values for request-body-limit and response-body-limit configurations.
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.
Uncontrolled buffer expansion in Suricata's DCERPC parser allows remote attackers to trigger unbounded memory allocation and cause denial of service by sending specially crafted DCERPC traffic. The vulnerability affects versions prior to 8.0.3 and 7.0.14 across DCERPC/UDP, DCERPC/TCP, and SMB protocols, with TCP being partially protected by default stream depth limits. Patches are available, and administrators can mitigate by disabling vulnerable parsers or configuring stream reassembly depth limits.
Heap buffer overflow in Suricata 8.0.0 through 8.0.5 lets a user who can supply or modify a local detection rule crash the engine by loading a ruleset that pairs frame inspection without a content keyword with a transformed match that also lacks content. The flaw is reached during signature preparation in src/detect-engine-prefilter.c and fires even in config-test mode (suricata -T), so no live traffic is required, but it is strictly local, requires rule-loading privilege, and results only in a denial-of-service crash rather than code execution. This is a low-severity issue: the assessed CVSS vector is AV:L/PR:L with A:L impact only, there is no public exploit identified at time of analysis, and Suricata 8.0.6 plus the entire 7.x line are not affected.
An out-of-order FTP command sequence can blind Suricata's FTP inspection for the remainder of a TCP flow. In Suricata versions prior to 8.0.6, when an FTP client issues a RETR or STOR command before completing PORT or PASV negotiation, the parser in src/app-layer-ftp.c raises an unrecoverable application-layer error rather than flagging a recoverable protocol event; that fatal state disables FTP parsing for the rest of the flow, creating a reporting and rule-matching blind spot in IDS deployments while IPS deployments drop the affected flow outright. Remote attackers who can influence the FTP control channel visible to a sensor (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-755) can therefore evade parser-dependent rules and logging, but no target host is compromised and no confidentiality is lost; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in 8.0.6.
SIP body-length truncation in Suricata 8.0.0 through 8.0.5 causes the IDS/IPS engine to expose only the first 65,536 bytes of oversized SIP request or response bodies to frame-based inspection, letting an unauthenticated remote attacker hide malicious content in the omitted remainder and evade detection. The flaw resides in the Rust SIP parser, which stores body offsets and lengths in 16-bit fields, so any body larger than 65,536 bytes wraps the stored length; this only matters on deployments that enable SIP application-layer parsing and run rules referencing frame:request.body or frame:response.body, and it degrades detection integrity only (no crash, no code execution, no data exposure). Per the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, score 3.7) the impact is limited to integrity of the detection pipeline, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unbounded transmit (tx) buffer growth in the Linux kernel's DHCP subsystem can exhaust system memory when traffic is unidirectional. The defect allows the kernel's DHCP-related transmit path to accumulate resources indefinitely - packets or descriptors are enqueued without corresponding release when bidirectional flow acknowledgment is absent. Systems running DHCP client or server functionality via the affected kernel subsystem are exposed to denial-of-service through memory exhaustion. No public exploit has been identified at time of analysis.
IPv4/IPv6 hash collision in Suricata's IPPair tracking mechanism causes the engine to reuse state belonging to the wrong IP pair, leading to incorrect stateful evaluation of network traffic. The vulnerability affects deployments where both IPv4 and IPv6 traffic is processed and IPPair-based rules or datasets are active. An attacker who can craft traffic that induces a hash collision may cause Suricata to apply the wrong connection state, potentially bypassing detection rules that depend on per-pair tracking. No public exploit or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in the datasets library (likely HuggingFace datasets or a similar data-processing package) crashes the host process when parsing unexpected or malformed NDJSON (Newline Delimited JSON) files. Any application or pipeline that loads attacker-influenced NDJSON data through the affected library is exposed to a denial-of-service condition. No public exploit has been identified at time of analysis, and no CVSS or CWE data has been assigned yet by NVD.
Heap buffer overflow in SWF (Shockwave Flash) decompression depth handling affects a file analysis engine - most likely ClamAV, based on the 'detect/file_data' module path and Ubuntu as the reporting vendor. An attacker can supply a specially crafted SWF file that, when scanned, triggers out-of-bounds writes on the heap during recursive or depth-tracked decompression, potentially leading to process crash or arbitrary code execution within the scanning daemon. No patch version, CVSS vector, or CWE is included in the input; no public exploit is identified at time of analysis.
SMTP evasion via incomplete state reset in an Ubuntu-reported component allows an attacker to bypass protocol-level security controls by exploiting improper state machine cleanup between SMTP sessions or command sequences. The vulnerability enables crafted SMTP interactions to carry over state from a prior transaction into a new one, potentially allowing filter evasion, spoofed sender identity acceptance, or bypass of per-message security checks. No CVSS score, CWE, or patch version is currently assigned in NVD, and data is extremely sparse - the analysis below reflects significant inference from the vulnerability class.
Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.
Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a stack buffer overflow when processing oversized datasets with the save or state options enabled, allowing an attacker with network access to cause a denial of service. The vulnerability requires specific conditions to trigger but does not require authentication or user interaction. A patch is available in the latest versions.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 26.7% and no vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
A security vulnerability in Suricata (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Suricata 4.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Suricata 4.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.
Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
Denial of service in Suricata versions 8.0.0 through 8.0.5 allows unauthenticated remote attackers to exhaust sensor CPU and degrade packet-processing throughput by sending crafted DNS-over-HTTP/2 traffic. The HTTP/2 DoH parser retains previously processed DATA frame contents instead of clearing its internal buffer, so a series of DATA frames with the EndOfStream flag set repeatedly reprocesses old data while the buffer grows toward its 65 KiB limit, yielding quadratic CPU cost and potential loss of network monitoring visibility. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patch 8.0.6 closes the issue.
Remote, unauthenticated attackers can exhaust CPU and memory on Suricata 8.0.0 through 8.0.5 sensors by sustaining application-layer traffic on flows that are handled by a pass rule or a pass-the-flow exception policy, degrading the IDS/IPS to a denial-of-service condition. The defect is an inverted guard in AppLayerParserSetTransactionInspectId() that marks only already-inspected transactions as inspected, so on those pass-handled flows detection is skipped and completed transactions are never marked or freed, accumulating in the per-flow list and being rescanned with quadratic cleanup cost. Only availability is affected (C:N/I:N/A:H); the issue is fixed in Suricata 8.0.6, and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in Suricata 8.0.5 allows remote, unauthenticated attackers to degrade an IDS/IPS sensor's packet processing by sending crafted FTP command data. When a single large chunk of FTP commands exceeds the configured app-layer.protocols.ftp.max-tx limit, the FTP parser keeps allocating transactions and then repeatedly walks the oversized transaction list with quadratic cost, triggering the too_many_transactions event and driving CPU consumption that reduces monitoring visibility or stalls inspection entirely. Impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and is confined to the single 8.0.5 release; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Suricata 8.0.0 through 8.0.5 can be degraded into a denial-of-service condition by a remote, unauthenticated attacker who streams repeated small brotli-compressed HTTP/1 responses through a single inspected flow. The HTTP/1 parser caps the decompression work done per transaction but does not cap how many compression bombs a flow may submit, so each transaction forces the Rust htp decompression path to burn CPU until packet processing slows and monitoring visibility is lost; availability-only impact, with no confidentiality or integrity effect (CVSS base 7.5, CWE-400). Exploitation is gated on the non-default response-body-decompress-layer-limit setting being enabled and on the sensor seeing attacker-influenced traffic, and no public exploit or in-the-wild activity is identified at time of analysis; the vendor fixed the issue in Suricata 8.0.6.
Deadlock in the Linux kernel IP defragmentation subsystem occurs when processing fragmented encapsulated (tunneled) traffic, allowing a remote attacker to trigger a kernel locking deadlock by sending specially crafted fragmented tunnel packets. Any Linux system with active tunnel interfaces (GRE, IPIP, VXLAN, or similar encapsulation) and IP defragmentation enabled is potentially affected. The result is a denial-of-service condition causing the affected network path or system to hang, with no confidentiality or integrity impact identified. No public exploit or active exploitation has been identified at time of analysis.
An out-of-bounds read in Suricata's MIME quoted-printable decoder affects versions 7.0.13 through 7.0.16 and lets remote, unauthenticated attackers crash a sensor that inspects crafted MIME-bearing traffic, most plausibly SMTP email. Because Suricata parses passively, no credentials or user interaction are required, but exploitation only matters where MIME/SMTP app-layer inspection is actually running on an attacker-reachable path; the realistic outcome is a denial-of-service sensor crash, with only limited potential for exposing adjacent memory (the assessed Confidentiality impact is Low, not High). Patch status: Vendor-released patch - Suricata 7.0.17; EPSS is low (0.56%, 46th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis.
Unquoted LocalSystem service ImagePath in a Windows component distributed by Ubuntu/Canonical enables local privilege escalation to SYSTEM. When a Windows service ImagePath contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the binary by trying each path segment prefix in order - allowing a lower-privileged local attacker who can write to an intermediate directory to place a malicious executable that runs under LocalSystem context on next service start or system reboot. No patch version, CVSS score, or CWE has been assigned in the input data; no public exploit or KEV listing is present at time of analysis.
Resource exhaustion in an MQTT implementation tracked by Ubuntu allows an attacker to submit an unbounded number of messages within a single transaction, likely leading to memory or CPU exhaustion and denial of service. The affected component, version range, and exact package have not been confirmed from the available data - only Ubuntu's vendor tracking is present. No CVSS score, CWE, EPSS, KEV listing, or patch information was provided, making a full risk assessment impossible at this time.
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Denial of service in Suricata IDS/IPS/NSM engine (versions prior to 7.0.16 and 8.0.5) allows an unauthenticated remote attacker to exhaust CPU resources by sending HTTP responses containing crafted oversized `Content-Disposition` headers, causing the inspection engine to perform repeated expensive parsing iterations without bounds. The attack requires no privileges and exploits the security tooling itself - disabling Suricata's inspection capability - which can serve as a precursor to attacks that would otherwise be detected. No public exploit code and no CISA KEV listing have been identified, but the OISF has released patched versions and a rule-based workaround.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
A use-after-free in Suricata's inspection-buffer helper can crash or destabilize the detection engine (availability impact only) when a ruleset chains the `dotprefix` transform after another transform on the same inspection buffer, causing the backing buffer to be reallocated while a stale inspection pointer is retained. Affected deployments are Suricata before 7.0.16 and 8.0.x before 8.0.5; the flaw is remotely reachable (CVSS AV:N, PR:N, no user interaction) but exploitation is gated by a non-default, defender-controlled rule configuration plus traffic that traverses that specific inspection path, which is why our assessment raises the attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's base score of 7.5. No public exploit code has been identified at time of analysis, there is no CISA KEV listing (SSVC exploitation: none, automatable: no), and EPSS is low at 0.51% (42nd percentile). Vendor-released fixes are available in 7.0.16 and 8.0.5.
NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.
Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.
Local privilege escalation in the openSUSE Tumbleweed packaging of Suricata allows the unprivileged 'suricata' service account to gain root through a symbolic-link following flaw (CWE-61) in files or directories the package manages with predictable, service-writable paths. Any actor already holding the suricata user context - for example via a compromised or misconfigured IDS/IPS process - can plant a symlink that redirects a root-executed operation to a target of their choosing, yielding full system compromise. The CVSS 4.0 exploit-maturity metric is set to Proof-of-Concept (E:P); there is no evidence of active exploitation in CISA KEV, and no public exploit identified at time of analysis.
Network denial-of-service in Suricata prior to 7.0.15 allows remote unauthenticated attackers to degrade intrusion detection performance via inefficient DCERPC buffering. The flaw enables attackers to bypass or impair network security monitoring by exhausting system resources through malformed DCERPC traffic, effectively blinding detection capabilities. No public exploit identified at time of analysis, though EPSS score and exploitation likelihood were not provided in available data.
Memory exhaustion in Suricata network IDS/IPS via HTTP/2 CONTINUATION frame flooding allows remote unauthenticated attackers to trigger denial of service, typically forcing operating system termination of the Suricata process. Affects all versions prior to 7.0.15 and 8.0.4. EPSS data not available, but CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no privileges. No public exploit identified at time of analysis, though the attack technique (HTTP/2 frame flooding) is well-documented in protocol security research.
Denial of service in Suricata 8.0.0 through 8.0.3 allows unauthenticated remote attackers to degrade performance via specially crafted SMTP traffic containing MIME-encoded messages with URLs. The quadratic complexity vulnerability (CWE-407) triggers excessive processing when the IDS/IPS engine searches for URLs in malformed messages. EPSS data not provided, but exploitation probability appears low given no public exploit identified at time of analysis and the requirement for sustained malicious SMTP traffic to achieve impact.
Network-accessible resource exhaustion in Suricata IDS allows remote attackers to degrade detection performance via specially crafted traffic. Affects versions prior to 7.0.15 and 8.0.4 (CVSS 7.5 HIGH). Attack requires no authentication (PR:N) and low complexity (AC:L), enabling trivial performance degradation that could blind security monitoring. EPSS data not available, but no public exploit identified at time of analysis. Vendor patches released for both affected branches (7.0.15, 8.0.4).
Performance degradation in Suricata IDS/IPS engine allows remote unauthenticated attackers to cause denial of service through inefficient Kerberos 5 buffering. Affects versions prior to 7.0.15 and 8.0.4. CVSS 7.5 with high availability impact. No public exploit identified at time of analysis, EPSS data not provided. Vendor-released patches available in versions 7.0.15 and 8.0.4.
NULL pointer dereference in Suricata 8.0.0 through 8.0.3 causes denial of service when processing malformed TLS traffic with the 'tls.alpn' rule keyword. Remote unauthenticated attackers can crash the IDS/IPS engine by sending specially crafted network packets, completely disabling network security monitoring. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with high availability impact (A:H) indicate significant operational risk for organizations relying on Suricata for traffic inspection. No evidence of active exploitation (no CISA KEV listing) or public exploit code identified at time of analysis.
Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.
Suricata versions 8.0.0 through 8.0.2 are susceptible to a stack overflow crash when processing network traffic with improperly configured body size limits. An unauthenticated remote attacker can trigger a denial of service by sending crafted requests that exceed the application's stack capacity. A patch is available in version 8.0.3, or administrators can apply the workaround of using default values for request-body-limit and response-body-limit configurations.
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.
Uncontrolled buffer expansion in Suricata's DCERPC parser allows remote attackers to trigger unbounded memory allocation and cause denial of service by sending specially crafted DCERPC traffic. The vulnerability affects versions prior to 8.0.3 and 7.0.14 across DCERPC/UDP, DCERPC/TCP, and SMB protocols, with TCP being partially protected by default stream depth limits. Patches are available, and administrators can mitigate by disabling vulnerable parsers or configuring stream reassembly depth limits.
Heap buffer overflow in Suricata 8.0.0 through 8.0.5 lets a user who can supply or modify a local detection rule crash the engine by loading a ruleset that pairs frame inspection without a content keyword with a transformed match that also lacks content. The flaw is reached during signature preparation in src/detect-engine-prefilter.c and fires even in config-test mode (suricata -T), so no live traffic is required, but it is strictly local, requires rule-loading privilege, and results only in a denial-of-service crash rather than code execution. This is a low-severity issue: the assessed CVSS vector is AV:L/PR:L with A:L impact only, there is no public exploit identified at time of analysis, and Suricata 8.0.6 plus the entire 7.x line are not affected.
An out-of-order FTP command sequence can blind Suricata's FTP inspection for the remainder of a TCP flow. In Suricata versions prior to 8.0.6, when an FTP client issues a RETR or STOR command before completing PORT or PASV negotiation, the parser in src/app-layer-ftp.c raises an unrecoverable application-layer error rather than flagging a recoverable protocol event; that fatal state disables FTP parsing for the rest of the flow, creating a reporting and rule-matching blind spot in IDS deployments while IPS deployments drop the affected flow outright. Remote attackers who can influence the FTP control channel visible to a sensor (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-755) can therefore evade parser-dependent rules and logging, but no target host is compromised and no confidentiality is lost; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in 8.0.6.
SIP body-length truncation in Suricata 8.0.0 through 8.0.5 causes the IDS/IPS engine to expose only the first 65,536 bytes of oversized SIP request or response bodies to frame-based inspection, letting an unauthenticated remote attacker hide malicious content in the omitted remainder and evade detection. The flaw resides in the Rust SIP parser, which stores body offsets and lengths in 16-bit fields, so any body larger than 65,536 bytes wraps the stored length; this only matters on deployments that enable SIP application-layer parsing and run rules referencing frame:request.body or frame:response.body, and it degrades detection integrity only (no crash, no code execution, no data exposure). Per the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, score 3.7) the impact is limited to integrity of the detection pipeline, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unbounded transmit (tx) buffer growth in the Linux kernel's DHCP subsystem can exhaust system memory when traffic is unidirectional. The defect allows the kernel's DHCP-related transmit path to accumulate resources indefinitely - packets or descriptors are enqueued without corresponding release when bidirectional flow acknowledgment is absent. Systems running DHCP client or server functionality via the affected kernel subsystem are exposed to denial-of-service through memory exhaustion. No public exploit has been identified at time of analysis.
IPv4/IPv6 hash collision in Suricata's IPPair tracking mechanism causes the engine to reuse state belonging to the wrong IP pair, leading to incorrect stateful evaluation of network traffic. The vulnerability affects deployments where both IPv4 and IPv6 traffic is processed and IPPair-based rules or datasets are active. An attacker who can craft traffic that induces a hash collision may cause Suricata to apply the wrong connection state, potentially bypassing detection rules that depend on per-pair tracking. No public exploit or CISA KEV listing has been identified at time of analysis.
NULL pointer dereference in the datasets library (likely HuggingFace datasets or a similar data-processing package) crashes the host process when parsing unexpected or malformed NDJSON (Newline Delimited JSON) files. Any application or pipeline that loads attacker-influenced NDJSON data through the affected library is exposed to a denial-of-service condition. No public exploit has been identified at time of analysis, and no CVSS or CWE data has been assigned yet by NVD.
Heap buffer overflow in SWF (Shockwave Flash) decompression depth handling affects a file analysis engine - most likely ClamAV, based on the 'detect/file_data' module path and Ubuntu as the reporting vendor. An attacker can supply a specially crafted SWF file that, when scanned, triggers out-of-bounds writes on the heap during recursive or depth-tracked decompression, potentially leading to process crash or arbitrary code execution within the scanning daemon. No patch version, CVSS vector, or CWE is included in the input; no public exploit is identified at time of analysis.
SMTP evasion via incomplete state reset in an Ubuntu-reported component allows an attacker to bypass protocol-level security controls by exploiting improper state machine cleanup between SMTP sessions or command sequences. The vulnerability enables crafted SMTP interactions to carry over state from a prior transaction into a new one, potentially allowing filter evasion, spoofed sender identity acceptance, or bypass of per-message security checks. No CVSS score, CWE, or patch version is currently assigned in NVD, and data is extremely sparse - the analysis below reflects significant inference from the vulnerability class.
Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.
Heap buffer overflow in Suricata's rule parser allows a local attacker with write access to rule files to crash the Suricata process during signature loading by supplying a crafted rule containing mixed-case frame keywords. Affected versions are all releases prior to 7.0.16 and 8.0.5. Exploitation is constrained to rule-load time rather than live traffic inspection, limiting impact to availability disruption of the IDS/IPS engine itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.
Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to slowdown over multiple packets (CVSS 5.3).
Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a stack buffer overflow when processing oversized datasets with the save or state options enabled, allowing an attacker with network access to cause a denial of service. The vulnerability requires specific conditions to trigger but does not require authentication or user interaction. A patch is available in the latest versions.
Suricata versions up to 8.0.3 contains a vulnerability that allows attackers to severe slowdowns (CVSS 3.7).
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 26.7% and no vendor patch available.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
A security vulnerability in Suricata (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, that comes from a rule, may trigger absolute or relative directory traversal, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion.". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Suricata 4.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Suricata 4.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.