A stack-based buffer overflow in the Suricata network engine, affecting versions prior to 7.0.13 and 8.0.2, poses a significant denial of service risk.

The vulnerability is a stack-based buffer overflow (CWE-121) triggered when the engine processes an excessively large HTTP content type during logging. This flaw allows an unauthenticated remote attacker to cause a service crash, effectively disabling the network monitoring capabilities of the affected infrastructure.

The successful exploitation of this vulnerability results in a denial of service, which directly impacts the operational integrity of network security monitoring. With a CVSS score of 7.5, the risk is classified as High, as it allows unauthenticated attackers to disrupt critical security visibility, potentially masking further malicious activity while the IDS/IPS engine is offline.

Immediate Action: Upgrade all instances of Suricata to version 7.0.13, 8.0.2, or later to eliminate the vulnerability.

Proactive Monitoring: Monitor system logs for unexpected service restarts or process crashes that may indicate an attempt to trigger the buffer overflow.

Compensating Controls: If immediate patching is not feasible, restrict the stream reassembly depth via the configuration setting stream.reassembly.depth to less than half the stack size, or increase the process stack size to reduce the likelihood of a crash.

Public Exploit Available: No (exploit_available: unknown)

Given the critical role of Suricata in perimeter and network defense, the inability to monitor traffic due to a forced crash represents a significant security gap. Administrators should prioritize the deployment of the provided patches in version 7.0.13 or 8.0.2 immediately to restore stable and secure operations.