CVE-2025-29915CWE-347

Suricata af-packet: defrag option can lead to truncated packets affecting visibility

High · published April 10, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2025-04-10T19:51Z
EPSS history
Timeline
  • 10 APR 19:51Z
    Suricata af-packet: defrag option can lead to truncated packets affecting visibility
    cvelistv5