Unauthenticated attackers can cause a denial of service in Suricata by sending crafted DCERPC traffic that triggers uncontrolled memory allocation.

This vulnerability is an uncontrolled resource consumption flaw (CWE-400) where the application fails to limit buffer expansion when processing DCERPC traffic. The issue is reachable by unauthenticated remote attackers via UDP, TCP, or SMB protocols.

Successful exploitation results in process termination, causing a complete loss of network intrusion detection and prevention capabilities. Given the CVSS score of 7.5, this high severity vulnerability poses a critical threat to network security infrastructure, as a disruption of Suricata leaves the perimeter vulnerable to secondary attacks that would otherwise be blocked.

Immediate Action: Update Suricata to version 7.0.14 or 8.0.3 immediately to incorporate the necessary buffer management patches.

Proactive Monitoring: Monitor system logs for frequent process restarts or memory exhaustion errors that may indicate an attempt to trigger this crash.

Compensating Controls: For DCERPC over UDP, disable the parser. For DCERPC over TCP or SMB, configure the stream.reassembly.depth setting to impose a strict limit on buffered data.

Public Exploit Available: No

Organizations relying on Suricata for network security must prioritize this update, as the ability for an unauthenticated attacker to remotely crash an IPS/IDS engine presents an unacceptable security risk. Please apply the vendor provided patches or implement the recommended stream reassembly depth limits immediately to maintain operational integrity.