Technical impact
Suricata, a network IDS, IPS and NSM engine, suffers from quadratic processing complexity in its stream inspection routine. When an attacker sends specially crafted traffic, the engine's packet handling slows dramatically, reducing throughput and potentially causing the IDS to fall behind legitimate traffic. This weakness corresponds to resource exhaustion and poor input handling, allowing an attacker to deplete processing resources.
Affected Systems
All versions of OISF Suricata prior to 7.0.15 and 8.0.4 are affected. Users of the 7.x line must upgrade to 7.0.15 or later; users of the 8.x line must upgrade to 8.0.4 or later to receive the fix.
Risk and Exploitability
The CVSS score is 7.5, indicating a high severity impact on availability. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved by an attacker who can inject crafted traffic into the network stream observed by Suricata. No special privileges or local access are required; the attack vector is a remote network-based injection. Successful exploitation results in degraded performance or a denial of service. No workaround is available beyond applying the patch.
