A null pointer dereference occurs when the tls.alpn rule keyword is used in Suricata versions 8.0.0 through 8.0.3. The bug causes the IDS/IPS engine to crash, resulting in a denial of service that can disable traffic inspection and alerting.

Affected systems are the OISF Suricata network monitoring platform versions 8.0.0 to 8.0.3 inclusive. The vulnerability applies to any deployment that uses the tls.alpn keyword in its rule set. Users of later releases, such as 8.0.4 and beyond, are not impacted.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The bug is not listed in the CISA KEV catalog. Likely attack vectors require a Suricata instance processing a TLS handshake that includes the ALPN field set to a value that triggers the crash. The flaw is exploitable by any network entity that can send such traffic to the monitored hosts, though only a misconfigured or malicious source would typically target it.