A stack-based buffer overflow vulnerability in the Suricata network engine allows unauthenticated attackers to crash the service, resulting in a potential denial of service.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered during SWF decompression. It can be exploited by an unauthenticated network-based attacker to cause the Suricata engine to crash.

The vulnerability carries a CVSS score of 7.5, which falls into the High severity range. As Suricata is a critical component for network intrusion detection and prevention, a successful exploit would result in a denial of service, effectively blinding security teams to malicious network activity and leaving the organization vulnerable to further undetected attacks.

Immediate Action: Update to Suricata version 7.0.13 or 8.0.2 immediately to incorporate the provided security patches.

Proactive Monitoring: Monitor network logs for service interruptions or unexpected process terminations associated with the Suricata daemon.

Compensating Controls: If patching is not immediately feasible, disable SWF decompression by setting swf-decompression to false in the suricata.yaml configuration file, as this feature is disabled by default.

Public Exploit Available: No

The vulnerability poses a significant risk to organizational visibility by targeting the very security infrastructure intended to monitor the network. Administrators should prioritize patching to the latest stable versions to eliminate the stack overflow condition, or ensure the non-essential SWF decompression feature remains disabled in their environment.