A vulnerability in the Suricata network engine allows unauthenticated remote attackers to cause a denial of service via memory exhaustion.

This vulnerability involves uncontrolled resource consumption (CWE-400) within the DNP3 traffic parser. Unauthenticated attackers can send specifically crafted packets to trigger excessive memory allocation, causing the process to be terminated by the operating system OOM killer.

The exploitation of this vulnerability results in a denial of service for the network intrusion detection and prevention system. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to network visibility and security enforcement, potentially leaving the monitored infrastructure exposed to further attacks while the security engine is offline.

Immediate Action: Upgrade to Suricata version 7.0.14 or 8.0.3 immediately to implement the necessary memory management patches.

Proactive Monitoring: Monitor system logs and process status for unexpected service restarts or high memory utilization warnings associated with the Suricata process.

Compensating Controls: If patching is not immediately feasible, disable the DNP3 protocol parser in the Suricata YAML configuration file, as this feature is often disabled by default and serves as the primary attack vector.

Public Exploit Available: No

Organizations relying on Suricata for network security must prioritize this update to maintain operational stability and security posture. Given the ease of exploitation and the critical role of network monitoring, applying the vendor-supplied patch is the only definitive way to resolve the underlying resource consumption flaw.