This vulnerability arises from quadratic complexity in the Kerberos 5 buffering subsystem within Suricata. The flaw allows an attacker to trigger excessive memory consumption and sluggishness when the engine processes Kerberos traffic, potentially leading to a denial of service. It is classified under CWE‑407 (Improper Resource Management) and CWE‑770 (Memory Allocation).

Affected deployments are those running Suricata versions earlier than 7.0.15 or 8.0.4. The vendor OISF has released patches in those two releases. Any installation using Suricata 7.0.0‑7.0.14 or 8.0.0‑8.0.3 is susceptible.

The CVSS score of 7.5 denotes a high severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Nevertheless, the attack vector is inferred to be remote via crafted Kerberos packets that can be sent over the network, exploiting the quadratic buffering path when it is actively parsing traffic. The risk is therefore a remote denial of service that could degrade or halt network monitoring services if the attacker can sustain a high volume of malicious traffic.