High · published November 27, 2025
⚡ A stack overflow vulnerability lurks in Suricata that can trigger on large HTTP file transfers if you’ve cranked up the response limits! Think of it like pouring a giant soda into a cup that’s meant for a small coffee — it overflows everywhere, causing a messy situation! If the logging feature is enabled, it could make this soda spill even bigger. An attacker could exploit this vulnerability to cause a stack overflow during large file transfers, potentially crashing the system. This means your network could go down, leaving your defenses in shambles while they take advantage of the situation!
Think of it like pouring a giant soda into a cup that’s meant for a small coffee — it overflows everywhere, causing a messy situation! If the logging feature is enabled, it could make this soda spill even bigger. This stack overflow vulnerability arises when users increase the HTTP response body limit while logging printable HTTP bodies. The overflow can disrupt service if large transfers are processed.
An attacker could exploit this vulnerability to cause a stack overflow during large file transfers, potentially crashing the system. This means your network could go down, leaving your defenses in shambles while they take advantage of the situation! To protect against this vulnerability, update Suricata to versions 7.0.13 or 8.0.2 immediately. Alternatively, you can mitigate the issue by restoring the default HTTP response body limits and disabling HTTP body logging, which is turned off by default. You've got this! Follow these steps, and you’ll have your Suricata setup back in tip-top shape in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| oisf/suricata | < 7.0.13 | 7.0.13 |
| oisf/suricata | ≥ 8.0.0, < 8.0.2 | 8.0.2 |