CyberRota Analysis
AI-GeneratedSuricata versions prior to 7.0.16 and 8.0.5 are vulnerable to a memory consumption issue in the IKEv2 parser, which can be exploited through specially crafted UDP traffic, leading to potential denial of service. Organizations using Suricata for network security should prioritize updating to the fixed versions or implementing recommended workarounds, especially those relying on IKE application-layer parsing. This vulnerability poses a significant risk to network availability and security monitoring capabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.