CVE-2025-59148

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan NULL Pointer Dereference pada oisf suricata. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.

Rincian

Terbit di NVD

1 Oktober 2025

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c patch
• https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3 issue tracking · advisory pihak ketiga
• https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018 release notes
• https://redmine.openinfosecfoundation.org/issues/7838 issue tracking