Suricata, a network intrusion detection and prevention engine, is vulnerable to a heap-use-after-free condition caused by an unsigned integer overflow during alert queue expansion. The flaw arises when a single packet triggers an excessive number of alerts, potentially leading to memory corruption, application crashes, and, in worse‐case scenarios, arbitrary code execution. The vulnerability is rooted in CWE‑416, a classic use‑after‑free weakness.

The issue affects the OISF Suricata product, specifically all releases prior to version 8.0.3 and 7.0.14. The security advisory explicitly lists these vulnerable releases, and later patches address the overflow and heap misuse.

Suricata assigns a CVSS score of 7.4, indicating a high severity level, yet the EPSS score is reported as less than 1 percent, suggesting a very low probability of public exploitation at the time of assessment. The vulnerability is not present in CISA’s KEV catalog. The likely attack vector involves the delivery of crafted network traffic that triggers an overwhelming number of alerts within a single packet, especially when running untrusted or overly permissive rule sets. A workaround is to limit the number of active signatures that can match a single packet to fewer than 65536, thereby preventing the overflow scenario.