Technical impact
Suricata, a network intrusion detection and prevention engine, contains a quadratic time complexity bug in its DCERPC buffering code. The flaw can cause significant slowdowns when handling DCERPC traffic, leading to degraded performance or a denial‑of‑service condition. The weakness is identified as a resource exhaustion issue, as reflected by the CWE identifiers for inefficient algorithmic complexity and memory allocation errors.
Affected Systems
The vulnerability affects the OISF Suricata product. All releases prior to version 7.0.15 are impacted; version 7.0.15 and later contain a fix that removes the inefficient buffering logic.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity vulnerability, yet the EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low current exploitation activity. A likely attack vector would involve a remote attacker sending crafted DCERPC packets through the network to the Suricata instance, triggering the quadratic buffering routine and exhausting CPU resources. Without mitigation, an attacker could force the IDS into a state of reduced responsiveness, impacting network monitoring and potentially allowing other malicious traffic to pass undetected.
