CVE-2025-59148CWE-476

CVE-2025-59148

High · published October 2, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-10-02T00:18Z
Affected products (3)
ProductVersionsFixed in
oisf/suricataall versions—
oisf/suricataall versions—
oisf/suricataall versions—
References (4)
https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018 · [email protected]https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c · [email protected]https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3 · [email protected]https://redmine.openinfosecfoundation.org/issues/7838 · [email protected]
EPSS history
Timeline
  • 01 OCT 19:51Z
    Suricata's improper use of entropy keyword can lead to a NULL-ptr deref
    cvelistv5