A stack overflow vulnerability in Suricata versions 8.0.0 through 8.0.2 allows unauthenticated attackers to trigger a service crash, resulting in a denial of service.

The software is susceptible to a stack overflow caused by uncontrolled recursion (CWE-674). An unauthenticated remote attacker can trigger this condition by sending crafted traffic that forces the engine to exceed its stack limits.

Successful exploitation of this vulnerability results in a denial of service, causing the Suricata engine to crash. Given that Suricata is a critical component for network intrusion detection and prevention, a crash leaves the network segment unmonitored and vulnerable to further exploitation by other threats. With a CVSS score of 7.5, the high availability impact justifies immediate attention to maintain security visibility.

Immediate Action: Update all instances of Suricata to version 8.0.3 or later to resolve the underlying recursion issue.

Proactive Monitoring: Monitor system logs for unexpected service termination or crash reports related to the Suricata process.

Compensating Controls: If immediate patching is not feasible, restore stability by reverting the configuration of request-body-limit and response-body-limit to their default values to mitigate the trigger conditions.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to network security infrastructure due to the potential for an unauthenticated attacker to disable monitoring capabilities. Organizations should prioritize updating to version 8.0.3 immediately to ensure continuous security operations and prevent service disruption.