CyberRota Analysis
AI-GeneratedSuricata versions 8.0.0 to 8.0.6 are vulnerable due to a flaw in the AppLayerParserSetTransactionInspectId() function, which improperly marks transactions, allowing completed transactions to remain unmarked and leading to unbounded growth of the per-flow list. This can result in significant CPU and memory exhaustion, potentially impacting system performance and stability. Organizations using affected Suricata versions should prioritize upgrading to version 8.0.6 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)