CVE-2026-63446

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Missing Release of Memory after Effective Lifetime pada oisf suricata. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime
CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m mitigasi · advisory vendor
• https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8 patch
• https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7 patch
• https://github.com/OISF/suricata/pull/15726 patch
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes
• https://redmine.openinfosecfoundation.org/issues/8628 permissions required