A NULL pointer dereference vulnerability in Suricata version 8.0.0 can be exploited by an unauthenticated attacker to cause a denial of service via a segmentation fault.

This vulnerability is a NULL pointer dereference (CWE-476) occurring within the tls.subjectaltname keyword processing logic. An unauthenticated attacker can trigger this condition by providing a specially crafted subjectaltname containing a NULL byte.

The exploitation of this vulnerability results in a segmentation fault, which causes the Suricata process to crash. Given that Suricata serves as a critical network IDS/IPS engine, this denial of service condition leaves the network environment blind to potential threats, effectively disabling security monitoring infrastructure. The CVSS score of 7.5 reflects a High severity due to the ease of triggering the crash remotely without authentication.

Immediate Action: Update Suricata to version 8.0.1 or later to resolve the underlying code defect.

Proactive Monitoring: Review system logs for frequent Suricata service restarts or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: If an immediate update is not feasible, disable any inspection rules that utilize the tls.subjectaltname keyword to prevent the triggering of the vulnerable code path.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to network availability and security visibility. Administrators should prioritize patching to version 8.0.1 immediately, as the vulnerability is remotely exploitable and does not require authentication. If patching is delayed, the provided workaround of disabling specific rules is essential to maintain the stability of the security appliance.