A quadratic complexity issue exists in Suricata’s smtp/mine component when extracting URLs from MIME-encoded SMTP messages. The flaw can cause excessive CPU usage and memory consumption, leading to degraded performance or a denial of service on the affected system. The weakness is classified as CWE‑1333 (Excessive Computation) and CWE‑407 (Improper Resource Management).

The issue affects the OISF Suricata product, specifically versions 8.0.0 through 8.0.3. Users running any of these releases should verify that their deployment is affected and plan to upgrade.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is below 1%, indicating low current exploit probability, and it is not listed in CISA’s KEV catalog. The likely attack vector is an attacker sending specially crafted SMTP MIME traffic to a Suricata instance, which could trigger the high‑complexity algorithm and drain resources.