CVE-2026-63450

Katalog CVE

CVSS 5.3 · Medium EPSS 0,25%

Kerentanan Improper Handling of Exceptional Conditions pada oisf suricata. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr advisory vendor
• https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18 patch
• https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc patch
• https://github.com/OISF/suricata/pull/15704 patch
• https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 release notes
• https://redmine.openinfosecfoundation.org/issues/8659 permissions required