CyberRota Analysis
AI-GeneratedSuricata versions 8.0.0 to 8.0.4 are vulnerable to a flaw in Lua rule handling, where excessive flow variables can corrupt the Lua detection state, potentially bypassing the security sandbox and leading to crashes. Organizations utilizing Suricata for network intrusion detection and prevention should prioritize upgrading to version 8.0.5 or disabling Lua rules to mitigate this risk. This vulnerability poses a significant threat to network security and operational stability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.