A stack-based buffer overflow in the Suricata network engine, affecting versions prior to 7.0.13 and 8.0.2, poses a significant risk of service disruption.

The vulnerability is a stack-based buffer overflow (CWE-121) triggered when handling large data buffers within Lua scripts. This flaw is remotely exploitable by an unauthenticated attacker who can craft traffic to trigger the overflow during rule or output script processing.

The exploitation of this vulnerability leads to a denial of service, as the stack overflow causes the Suricata engine to crash. Given that Suricata is a critical component for network intrusion detection and prevention, an outage of this service leaves the network environment blind to malicious activity, effectively bypassing security controls. With a CVSS score of 7.5, this represents a high-severity risk to operational availability and network security posture.

Immediate Action: Update Suricata installations to version 7.0.13 or 8.0.2 immediately to incorporate the provided security patches.

Proactive Monitoring: Monitor service logs for unexpected process crashes or restarts associated with the Suricata engine, and audit Lua script execution patterns for signs of anomalous buffer usage.

Compensating Controls: If patching is not immediately feasible, disable all Lua-based rules and output scripts, or configure stream depth and HTTP response body limits to be less than half the available stack size.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability stems from its ability to disable critical network security infrastructure without requiring authentication. Organizations relying on Suricata for perimeter or internal defense should prioritize the transition to version 7.0.13 or 8.0.2 during the next maintenance window. If immediate updates are not possible, the documented workarounds regarding Lua script management are essential to maintain system stability and prevent service degradation.