Suricata’s routine that extracts URLs from MIME‑encoded SMTP messages has quadratic‑time complexity. When a large number of URLs are present, the parser can consume excessive CPU cycles, which degrades overall performance. If an attacker repeatedly injects such traffic, the system can become overwhelmed, leading to a denial‑of‑service condition. This weakness corresponds to CWE‑407, which describes time‑complexity vulnerabilities.

The flaw affects the Open Information Security Foundation’s Suricata network IDS/IPS, specifically versions from 8.0.0 up through 8.0.3. Versions 8.0.4 and later contain the necessary patch.

The CVSS score of 7.5 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is unavailable. The likely attack vector is a network‑based approach that requires an attacker to send crafted SMTP traffic to a susceptible Suricata deployment. Without remediation, the impact could be sustained CPU exhaustion and service disruption, but no direct information about exploitability conditions beyond network traffic is provided in the official description.