TI-2024-21739 Aliases CVE-2024-32867

Suricata's defrag contains various issues leading to policy bypass

LOW 31CWE-754Published 2024-05-07 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various problems in handling of fragmentation anomalies can lead to mis-detection of rules and policy. This vulnerability is fixed in 7.0.5 or 6.0.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00699 53rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OISF	suricata	6.0.0 – 6.0.18; 7.0.0 – 7.0.4	—	No fix listed	CNA

suricata VendorOISF Affected 6.0.0 – 6.0.18; 7.0.0 – 7.0.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oisf:suricata::::::::	6.0.0 to before 6.0.19; 7.0.0 to before 7.0.5	Vulnerable	OISF

cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.19; 7.0.0 to before 7.0.5 Vulnerable ·OISF

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-32867

References

Patch 6

Advisory 1

https://github.com/OISF/suricata/security/advisories/GHSA-xvrx-88mv-xcq5

Other 3

TI-2026-33506 ikev2: unbounded client transform storage can lead to resource exhaustion CVSS 3.1HIGH 7.5
TI-2026-33484 Suricata lua/tls: null dereference in TlsGetCertInfo CVSS 3.1HIGH 7.5
TI-2024-31811 Suricata ja4: invalid alpn leads to panic CVSS 3.1HIGH 7.5
TI-2020-13673 Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6… CVSS 3.1HIGH 7.5
TI-2023-17928 In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may… CVSS 3.1CRITICAL 9.8
TI-2026-63304 Use after free in OISF Suricata CVSS 3.1CRITICAL 9.4

See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences