crafted traffic can cause denial of service
Priority LOW 35CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01164 67th percentileScored 2026-11-07
Fix Fixed suricata (OISF): 6.0.16, 7.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OISF | suricata | before 6.0.16; 7.0.0 to before 7.0.3 | 6.0.16, 7.0.3 | Patch available | CNA |
- suricata VendorOISF Affected before 6.0.16; 7.0.0 to before 7.0.3 Fixed in 6.0.16, 7.0.3 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* | before 6.0.16; 7.0.0 to before 7.0.3 | Vulnerable | OISF |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* Versions before 6.0.16; 7.0.0 to before 7.0.3 Vulnerable ·OISF
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA suricata (OISF) Fixed in 6.0.16, 7.0.3
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23836
References
Patch 10
- https://github.com/OISF/suricata/commit/18841a58da71e735ddf4e52cbfa6989755ecbeb7
- https://github.com/OISF/suricata/commit/2a2120ecf10c5b5713ec2bf59469fe57f7b5b747
- https://github.com/OISF/suricata/commit/83c5567ea7b0b28376f57dcfee9c6301448c7bc7
- https://github.com/OISF/suricata/commit/8efaebe293e2a74c8e323fa85a6f5fadf82801bc
- https://github.com/OISF/suricata/commit/97953998d2d60673ed6c30ddfb6a2d59b4230f97
- https://github.com/OISF/suricata/commit/b1549e930f6426eeff43f12b672337cbcda566b8
- https://github.com/OISF/suricata/commit/cd035d59e3df157b606f4fe67324ea8e437be786
- https://github.com/OISF/suricata/commit/ce9b90326949c94a46611d6394e28600ee5e8bd5
- https://github.com/OISF/suricata/commit/e7e28822f473320658d6125f16ac3f0524baff01
- https://github.com/OISF/suricata/commit/f9de1cca6182e571f1c02387dca6e695e55608af
Other 8
- https://redmine.openinfosecfoundation.org/issues/6531
- https://redmine.openinfosecfoundation.org/issues/6532
- https://redmine.openinfosecfoundation.org/issues/6540
- https://redmine.openinfosecfoundation.org/issues/6658
- https://redmine.openinfosecfoundation.org/issues/6659
- https://redmine.openinfosecfoundation.org/issues/6660
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
More OISF Suricata vulnerabilities
- TI-2026-33506 ikev2: unbounded client transform storage can lead to resource exhaustion CVSS 3.1HIGH 7.5
- TI-2026-33484 Suricata lua/tls: null dereference in TlsGetCertInfo CVSS 3.1HIGH 7.5
- TI-2024-31811 Suricata ja4: invalid alpn leads to panic CVSS 3.1HIGH 7.5
- TI-2020-13673 Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6… CVSS 3.1HIGH 7.5
- TI-2023-17928 In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may… CVSS 3.1CRITICAL 9.8
- TI-2026-63304 Use after free in OISF Suricata CVSS 3.1CRITICAL 9.4
Sources
- CVE-2024-23836 · CVE Program
- CVE-2024-23836 · NVD
- FIRST EPSS
- CVE-2024-23836 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences