CVE-2024-23836CWE-770

crafted traffic can cause denial of service

High · published February 26, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
67.0
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01164 · 67.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-02-26T15:44Z
EPSS history
Timeline
  • 26 FEB 15:44Z
    crafted traffic can cause denial of service
    cvelistv5