A heap-based buffer overflow vulnerability in the Suricata network engine allows unauthenticated attackers to trigger a denial of service via service crashes.

This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the logging of verdict records in eve.alert and eve.drop. An unauthenticated attacker can trigger this condition by filling the per-packet alert queue and subsequently triggering a pass rule.

The vulnerability poses a direct threat to network availability, as a successful exploit causes the Suricata engine to crash. Given that Suricata often acts as a primary network defense component, its failure results in a significant blind spot for security operations, potentially allowing other malicious traffic to pass through undetected. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to maintain the integrity of security monitoring infrastructure.

Immediate Action: Upgrade to Suricata version 7.0.13 or 8.0.2 to implement the upstream fix.

Proactive Monitoring: Monitor system logs for frequent engine crashes or unexpected service restarts, and consider increasing the packet-alert-max value in the suricata.yaml configuration file as a temporary mitigation to reduce the likelihood of the overflow.

Compensating Controls: Ensure that network traffic is segmented and monitored, and employ secondary defensive layers to ensure visibility remains intact should the primary IDS/IPS service fail.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the stability of your network security stack. Organizations should prioritize updating to the patched versions of Suricata as soon as possible to prevent potential service disruption. If an immediate update is not feasible, increasing the alert queue size provides a necessary tactical buffer while scheduling the required maintenance.