Suricata, a network IDS/IPS, contains an inefficiency in its Kerberos5 buffering routine that can grow quadratically with the amount of traffic. An attacker who can force the IDS to process large volumes of Kerberos traffic can cause the system to slow dramatically or become overwhelmed, leading to a denial of legitimate network traffic. The flaw is a classic resource exhaustion problem, categorized as CWE‑407 and CWE‑770. No arbitrary code execution is possible.

The vulnerability affects the OISF Suricata product. All releases before 7.0.15 and 8.0.4 are impacted. Versions 7.0.15 and above, as well as 8.0.4 and later, contain the fix and are not affected.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation is not yet common, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote: an adversary can send crafted Kerberos packets into the network to trigger the quadratic buffering behavior. Because the issue is purely an efficiency bug, an attacker can only degrade performance rather than gain direct access to the system.