Suricata's Lua sandbox is intended to limit the memory consumption of Lua scripts using the configuration parameter security.lua.max-bytes. The vulnerability manifests when the sandbox fails to enforce this limit on newly allocated memory blocks. As a result, Lua scripts can allocate more memory than allowed, potentially exhausting system resources or causing unintended behavior. This represents an uncontrolled resource consumption flaw (CWE‑770).

Vulnerable versions are Suricata 8.0.0 through 8.0.4, inclusive. The issue exists when Lua rule execution is enabled and any Lua script or rule is loaded. Version 8.0.5 and later contain the necessary fix.

The CVSS base score is 5.9, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting a lower likelihood of widespread exploitation at the moment. However, an attacker would need the ability to enable Lua rules in Suricata and load or inject a Lua script that can generate large allocations. Once these conditions are met, the attacker could cause memory exhaustion. The lack of enforcement undermines the sandbox's protective intent.