CyberRota Analysis
AI-GeneratedThe MQTT parser in Suricata versions 7.0.0 to 7.0.17 and 8.0.6 is vulnerable to a denial-of-service attack due to its inability to limit the number of PUBREC or PUBREL messages in a single transaction. This flaw allows attackers to send crafted MQTT traffic that can indefinitely increase transaction state, leading to excessive CPU and memory consumption. Organizations using affected versions of Suricata should prioritize upgrading to the patched versions 8.0.6 or 7.0.17 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
Related CVEs
Other vulnerabilities affecting the same vendor(s)