Suricata processes XFF headers inefficiently when generating alerts outside an active transaction. This inefficiency can cause the engine to consume large amounts of CPU and memory, leading to dramatic performance degradation and potential denial of service. The flaw is classified as a resource exhaustion weakness (CWE‑1050).

The vulnerability affects the OISF Suricata network IDS/IPS before version 8.0.3 and before 7.0.14. Users running these versions with XFF support enabled are susceptible. The default configuration disables XFF, but if enabled the system is exposed.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score of less than 1% reflects a low likelihood of widespread exploitation. Suricata is not listed in the CISA KEV catalog. Exploitation would require traffic that triggers the slow alert path, so the attack vector is likely remote network traffic with XFF headers, with no known need for privileged access.