Suricata, an open‑source network IDS, IPS, and NSM engine, contains a flaw whereby crafted DCERPC traffic can cause an unbounded buffer to expand, exhausting system memory and forcing the process to be killed. This weakness corresponds to CWE‑400 (uncontrolled resource consumption) and CWE‑770 (resource exhaustion), and the primary impact is a denial of service that interrupts network monitoring.

Versions of Suricata older than 8.0.3 and 7.0.14 are affected. The vulnerability was demonstrated for DCERPC over UDP, and it is believed to also affect DCERPC over TCP and SMB when the stream.reassembly.depth option is left unlimited. In the default configuration, DCERPC/TCP is not vulnerable because the depth is capped at 1 MiB, whereas SMB defaults to unlimited, potentially exposing the system if left unchanged.

With a CVSS score of 7.5 the issue lies in the high‑severity range. The EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating a relatively low likelihood of exploitation. Nonetheless, an attacker who can reliably send large, fragment‑based DCERPC messages—most reliably over UDP—can trigger memory exhaustion and cause Suricata to crash, resulting in a denial of service against the IDS system.