Oisf Suricata
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Oisf Suricata.
By the Year
In 2026 there have been 28 vulnerabilities in Oisf Suricata with an average score of 6.9 out of ten. Last year, in 2025 Suricata had 21 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.11
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 28 | 6.85 |
| 2025 | 21 | 6.96 |
| 2024 | 17 | 7.01 |
| 2023 | 3 | 8.27 |
| 2022 | 0 | 0.00 |
| 2021 | 3 | 8.27 |
| 2020 | 1 | 0.00 |
| 2019 | 5 | 7.50 |
It may take a day or so for new Suricata vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Oisf Suricata Security Vulnerabilities
Suricata 8.08.0.5 Lua Flow Var Bypass & Crash
CVE-2026-45770
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Protection Mechanism Failure
Suricata IKEv2 Parser DoS (7.0.16/8.0.5)
CVE-2026-45769
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.
Resource Exhaustion
Suricata 8.0.0-8.0.4 LDAP unbounded-response memory exhaustion
CVE-2026-45768
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.
Resource Exhaustion
Suricata <7.0.16/8.0.5: Rule Load Allows Arbitrary File Overwrite
CVE-2026-45767
4.4 - Medium
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
Directory traversal
Suricata NFS Parser DoS before 7.0.16/8.0.5
CVE-2026-45766
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.
Resource Exhaustion
Suricata <7.0.16/8.0.5: DNP3 Buffer Overrun Causes DoS
CVE-2026-45765
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).
Resource Exhaustion
Suricata HTTP/2 Type Confusion Crash (fixed in 7.0.16/8.0.5)
CVE-2026-45764
9.1 - Critical
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 parsing if it is not required.
Object Type Confusion
Suricata IP Defrag Tracker IP Family Mismatch Crash (7.0.15/8.0.4)
CVE-2026-45762
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AF_PACKET, enabling AF_PACKET's `defrag` option may prevent Suricata from seeing such fragmented packets.
Object Type Confusion
Suricata rule parsing heap buffer overflow in frames (pre-7.0.16/8.0.5)
CVE-2026-45761
3.3 - Low
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Heap-based Buffer Overflow
Suricata <=7.0.15/8.0.4 HTTP Content-Disposition DoS
CVE-2026-45759
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP `Content-Disposition` headers during HTTP response body processing. Crafted HTTP traffic could cause excessive CPU usage and denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, use a rule like `alert http1 any any -> any any (sid: 1; http.request_header; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;)`.
Resource Exhaustion
Suricata 8.0.0-8.0.4 decompress transform buffer reuse crash
CVE-2026-45752
5.9 - Medium
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.
Dangling pointer
Suricata <7.0.16/8.0.5: Dangling Pointer After Chained Transform
CVE-2026-45751
5.9 - Medium
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing buffer to be reallocated. The issue is reached during a specific network traffic processing, and requires a specific but not malicious rule. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, avoid rules that chain `dotprefix` transform after another one.
Dangling pointer
Suricata Lua TLS Cert Helper NULL Deref before 7.0.16
CVE-2026-45747
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.
NULL Pointer Dereference
Suricata HTTP/2 Decompression Buffer Overflow (7.0.15, 8.0.4)
CVE-2026-46387
7.5 - High
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.
Data Amplification
Suricata 8.0.0-8.0.4 Lua Sandbox Memory Limit Bypass
CVE-2026-45763
5.9 - Medium
- September 10, 2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed `security.lua.max-bytes` without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Allocation of Resources Without Limits or Throttling
Suricata 7.0.15: DCERPC Buffering inefficiency causes perf degradation
CVE-2026-31937
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15.
Inefficient Algorithmic Complexity
Suricata 7.0.15/8.0.4 Patch: HTTP2 cont. frame flood mem exhaustion
CVE-2026-31935
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.
Resource Exhaustion
Suricata 8.0.08.0.3 MimeURL Quadratic Complexity Perf Impact
CVE-2026-31934
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, there is a quadratic complexity issue when searching for URLs in mime encoded messages over SMTP leading to a performance impact. This issue has been patched in version 8.0.4.
Inefficient Algorithmic Complexity
Suricata DOS due to crafted traffic before 7.0.15 & 8.0.4
CVE-2026-31933
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4.
Inefficient Algorithmic Complexity
Suricata KRB5 Buffer inefficiency degrades performance before 7.0.15/8.0.4
CVE-2026-31932
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, inefficiency in KRB5 buffering can lead to performance degradation. This issue has been patched in versions 7.0.15 and 8.0.4.
Inefficient Algorithmic Complexity
Suricata 8.0.08.0.3 Null Deref via tls.alpn Rule
CVE-2026-31931
7.5 - High
- April 02, 2026
Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, use of the "tls.alpn" rule keyword can cause Suricata to crash with a NULL dereference. This issue has been patched in version 8.0.4.
NULL Pointer Dereference
Suricata 8.0.2 / 7.0.13: Unsigned Int Overflow Heap UAF in Alert Gen
CVE-2026-22264
7.4 - High
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.
Dangling pointer
Suricata 8.0.x HTTP1 Header Parsing Slowdown (DOS)
CVE-2026-22263
5.3 - Medium
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available.
Excessive Platform Resource Consumption within a Loop
Suricata stack buffer overflow on dataset save (8.0.3,7.0.14)
CVE-2026-22262
5.9 - Medium
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the data in the dataset is too large, this can result in a stack overflow. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not use rules with datasets `save` nor `state` options.
Stack Overflow
Suricata XFF Slowdown (before 8.0.3/7.0.14)
CVE-2026-22261
3.7 - Low
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve configuration. The setting is disabled by default.
Excessive Platform Resource Consumption within a Loop
Suricata 8.0.0-8.0.2 Stack Overflow Crash via req/resp body limits
CVE-2026-22260
7.5 - High
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `response-body-limit`.
Stack Exhaustion
Suricata <7.0.14/8.0.3 DNP3 Parsing Memory Exhaustion (CVE-2026-22259)
CVE-2026-22259
7.5 - High
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).
Resource Exhaustion
Suricata <8.0.3: DCERPC Buffer Expansion Memory Exhaustion (CVE-2026-22258)
CVE-2026-22258
7.5 - High
- January 27, 2026
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.
Resource Exhaustion
Suricata Stack Overflow via Lua Buffers (vulnerable <7.0.13/8.0.2)
CVE-2025-64344
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Stack Overflow
Suricata < 7.0.13 / 8.0.2 Heap Overflow in eve.alert Logging
CVE-2025-64330
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
Heap-based Buffer Overflow
Suricata HTTP Body Overflow (7.0.12, 8.0.1)
CVE-2025-64331
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow can occur on large HTTP file transfers if the user has increased the HTTP response body limit and enabled the logging of printable http bodies. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves using default HTTP response body limits and/or disabling http-body-printable logging; body logging is disabled by default.
Stack Overflow
Suricata <7.0.13 or 8.0.2 SWF Decompression Stack Overflow Crash
CVE-2025-64332
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling SWF decompression (swf-decompression in suricata.yaml), it is disabled by default; set decompress-depth to lower than half your stack size if swf-decompression must be enabled.
Stack Overflow
Suricata <7.0.13/8.0.2 Stack Overflow via Large HTTP Content Type
CVE-2025-64333
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a large HTTP content type, when logged can cause a stack overflow crashing Suricata. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves limiting stream.reassembly.depth to less then half the stack size. Increasing the process stack size makes it less likely the bug will trigger.
Stack Overflow
NULL DEREF in Suricata 8.0.0-8.0.1 (entropy+base64_data)
CVE-2025-64335
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
NULL Pointer Dereference
Suricata 8.0.1 Unbounded Mem Growth via LZMA HTTP Decompression
CVE-2025-64334
7.5 - High
- November 26, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, compressed HTTP data can lead to unbounded memory growth during decompression. This issue has been patched in version 8.0.2. A workaround involves disabling LZMA decompression or limiting response-body-limit size.
Allocation of Resources Without Limits or Throttling
Suricata <8.0.1: tls.subjectaltname NULL byte -> segfault
CVE-2025-59150
7.5 - High
- October 01, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
NULL Pointer Dereference
Suricata 8.0.0 LDAP Attribute Type Stack Buffer Overflow
CVE-2025-59149
6.2 - Medium
- October 01, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Stack Overflow
Suricata 8.0.0-8.0.0 Entropy Keyword Segfault, Fixed in 8.0.1
CVE-2025-59148
7.5 - High
- October 01, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
NULL Pointer Dereference
Suricata Flow Tracking Bypass via MultiSYN Packet Attack (Pre7.0.12/Pre8.0.1)
CVE-2025-59147
7.5 - High
- October 01, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.
Improperly Implemented Security Check for Standard
Suricata <7.0.11/8.0.0 HTTP2 Stream 0 Memory Exhaustion DoS
CVE-2025-53538
- July 22, 2025
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.
Resource Exhaustion
Suricata decode_base64 bytes setting VULN: 4GiB per thread memory alloc
CVE-2025-29917
5.5 - Medium
- April 10, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9.
Allocation of Resources Without Limits or Throttling
Suricata PCRE Negated Rule Infinite Loop (before 7.0.9)
CVE-2025-29918
6.2 - Medium
- April 10, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.
Infinite Loop
Suricata AF_PACKET Defrag Truncation (<=7.0.8)
CVE-2025-29915
7.5 - High
- April 10, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
Improper Verification of Cryptographic Signature
Suricata hashsize OOB can cause DoS (fixed in 7.0.9)
CVE-2025-29916
5.5 - Medium
- April 10, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.
Allocation of Resources Without Limits or Throttling
Suricata BPF Buffer Overflow <7.0.8
CVE-2024-55626
3.3 - Low
- January 06, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file provided to Suricata at startup can lead to a buffer overflow at Suricata startup. The issue has been addressed in Suricata 7.0.8.
Integer Overflow to Buffer Overflow
Suricata 7.0.7: Buffer Overflow via UINT Underflow in memset Zero-Fill
CVE-2024-55627
7.5 - High
- January 06, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer underflow. The issue has been addressed in Suricata 7.0.8.
Memory Corruption
Suricata DNS RDATA DoS via Huge Hostnames, fixed in 7.0.8
CVE-2024-55628
7.5 - High
- January 06, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name compression can lead to small DNS messages containing very large hostnames which can be costly to decode, and lead to very large DNS log records. While there are limits in place, they were too generous. The issue has been addressed in Suricata 7.0.8.
Amplification
Suricata <7.0.8 TCP Urgent Data Evasion (fixed 7.0.8)
CVE-2024-55629
7.5 - High
- January 06, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.
Interpretation Conflict
Suricata <7.0.8 Stack Overflow via Transform Buffers
CVE-2024-55605
7.5 - High
- January 06, 2025
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to the to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor transform can lead to a stack overflow causing Suricata to crash. The issue has been addressed in Suricata 7.0.8.
Resource Exhaustion
Suricata <7.0.7 ALPN TLS/QUIC JA4 Panic Vulnerability
CVE-2024-47522
7.5 - High
- October 16, 2024
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. One may disable ja4 as a workaround.
assertion failure
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Oisf Suricata or by Oisf? Click the Watch button to subscribe.
