Suricata, a network intrusion detection and prevention engine, contains a flaw where a specially crafted data stream forces the stream inspection component to perform a quadratic number of operations, causing the engine to slow down dramatically. This excessive processing leads to degraded throughput and may render an IDS instance unresponsive, effectively denying service to legitimate traffic. The weakness corresponds to both inefficient resource usage (CWE-407) and potential denial of service (CWE-770).

The vulnerability affects Suricata releases before version 7.0.15 and 8.0.4 from the Open Information Security Foundation. Any deployment of these earlier builds in IDS or IPS mode that receives crafted traffic is potentially impacted.

The CVSS base score of 7.5 indicates high severity. No EPSS score is available, and the issue is not yet catalogued in the CISA KEV list. The simplest attack vector involves sending tailored packets that trigger the quadratic path; no exploit code is publicly documented, but the impact is observable as a noticeable performance loss in affected systems.