CVE-2026-63447

Katalog CVE

CVSS 7.5 · High EPSS 0,63%

Kerentanan Inefficient Algorithmic Complexity pada oisf suricata. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9 mitigasi · advisory vendor
• https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385 patch
• https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5 patch
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes
• https://redmine.openinfosecfoundation.org/issues/8592 permissions required