Advisories · Technology
OISF Suricata.
Every CVE that names OISF Suricata among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.4 CriticalCritical · CVSS 9+
Use after free in OISF Suricata
- OISF Suricata
- Memory corruption
- CVSS 9.4 CriticalCritical · CVSS 9+
Type confusion in OISF Suricata
- OISF Suricata
- Memory corruption
- CVSS 5.9 Medium
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
- OISF suricata
- CWE-697
- CVSS 7.5 High
Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
- OISF suricata
- Denial of service
- CVSS 7.0 High
Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
- OISF suricata
- CWE-428
- CVSS 7.5 High
Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption
- OISF suricata
- Denial of service
- CVSS 5.9 Medium
Suricata smb: some SMB flows can cause resource exhaustion
- OISF suricata
- Denial of service
- CVSS 5.3 Medium
Suricata smtp/mime: incomplete state reset allows detection bypass
- OISF suricata
- CWE-665
- CVSS 3.3 Low
Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption
- OISF suricata
- Denial of service
- CWE-409
- CVSS 3.3 Low
Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages
- OISF suricata
- Denial of service
- CVSS 3.7 Low
Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection
- OISF suricata
- CWE-755
- CVSS 3.7 Low
Suricata sip: large SIP message bodies can evade detection with frame keyword
- OISF suricata
- CWE-197
- CVSS 8.2 High
Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder
- OISF suricata
- Memory corruption
- CVSS 6.5 Medium
Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
- OISF suricata
- Denial of service
- CVSS 3.7 Low
Suricata swf: heap buffer overflow in SWF decompression depth handling
- OISF suricata
- Memory corruption
- CVSS 5.3 Medium
Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6
- OISF suricata
- CWE-697
- CVSS 7.5 High
Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata lua: excessive flow variable registration can bypass sandbox
- OISF suricata
- Memory corruption
- CWE-693
- CVSS 7.5 High
ikev2: unbounded client transform storage can lead to resource exhaustion
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
- OISF suricata
- Denial of service
- CVSS 4.4 Medium
Suricata datasets: save to absolute filename can be bypassed when combined with load command
- OISF suricata
- Path traversal
- CVSS 7.5 High
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata dnp3: unbounded reassembly can lead to resource exhaustion
- OISF suricata
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Suricata http2: protocol-change type confusion can lead to denial of service
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata defrag: missing address-family check can lead to remote crash
- OISF suricata
- Memory corruption
- CVSS 3.3 Low
Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata http1: quadratic Content-Disposition processing can lead to denial of service
- OISF suricata
- Denial of service
- CVSS 5.9 Medium
Suricata detect/transform: use-after-free in decompress transforms
- OISF suricata
- Memory corruption
- CVSS 5.9 Medium
Suricata detect/transform: use-after-free in dotprefix transform
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata lua/tls: null dereference in TlsGetCertInfo
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata http2: decompression bomb can cause denial of service in Suricata
- OISF suricata
- CWE-409
- CVSS 5.9 Medium
Suricata lua: sandbox allocation limit not enforced for new allocations
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata dcerpc: quadratic complexity in dcerpc buffering
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata http2: unbounded resource consumption
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata smtp/mine: quadratic complexity in extracting urls
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata stream: quadratic complexity in stream inspection
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata krb5: quadratic complexity in krb5 buffering
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata tls: null dereference in tls.alpn rule keyword
- OISF suricata
- Memory corruption
- CVSS 7.4 High
Suricata detect/alert: heap-use-after-free on alert queue expansion
- OISF suricata
- Memory corruption
- CVSS 5.3 Medium
Suricata http1: quadratic complexity in headers parsing over multiple packets
- OISF suricata
- CWE-1050
- CVSS 5.9 Medium
Suricata datasets: stack overflow when saving a set
- OISF suricata
- Memory corruption
- CVSS 3.7 Low
Suricata eve/alert: http1 xff handling can lead to denial of service
- OISF suricata
- CWE-1050
- CVSS 7.5 High
Suricata http1: infinite recursion in decompression
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata dnp3: unbounded transaction growth
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to a heap buffer overflow on verdict
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to a stack overflow on larger compressed data
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to a stack overflow from big content-type
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to a null deref when used with base64_data
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is vulnerable to unbounded memory growth for decompression
- OISF suricata
- Denial of service
- CVSS 7.5 High
Suricata: Keyword tls.subjectaltname can lead to NULL-ptr deref
- OISF suricata
- Memory corruption
- CVSS 6.2 Medium
Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata's improper use of entropy keyword can lead to a NULL-ptr deref
- OISF suricata
- Memory corruption
- CVSS 7.5 High
Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets
- OISF suricata
- CWE-358
- CVSS 7.5 High
Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation
- OISF suricata
- Denial of service