High · published November 27, 2025
⚡ Watch out for large buffers in Lua scripts! If you're using Suricata versions prior to 7.0.13 or 8.0.2, stack overflows might just sneak up on you. 🔥 Think of it like a restaurant that overfills a pot with soup. When it gets too full, it spills over the edges, causing a messy kitchen disaster! In this case, large buffers lead to a stack overflow, spilling out of bounds and causing chaos in your system. An attacker could exploit this vulnerability by crafting a rule that passes a hefty buffer to a Lua script, potentially causing a stack overflow. This could lead to unexpected behavior, crashing the Suricata engine, and leaving your network defenses vulnerable at a crucial moment.
Think of it like a restaurant that overfills a pot with soup. When it gets too full, it spills over the edges, causing a messy kitchen disaster! In this case, large buffers lead to a stack overflow, spilling out of bounds and causing chaos in your system. This stack overflow vulnerability allows for potential crashes when working with large buffers in Lua scripts in Suricata, affecting users who implement Lua rules and output scripts.
An attacker could exploit this vulnerability by crafting a rule that passes a hefty buffer to a Lua script, potentially causing a stack overflow. This could lead to unexpected behavior, crashing the Suricata engine, and leaving your network defenses vulnerable at a crucial moment. To protect your systems, upgrade to Suricata versions 7.0.13 or 8.0.2 immediately. If you can't upgrade right now, consider disabling Lua rules and output scripts, or set limits such as stream.depth.reassembly and HTTP response body limits to below half the stack size. Don't let your defenses overflow! You've got this! By following these steps, you'll keep your network defenses strong and safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| oisf/suricata | < 7.0.13 | 7.0.13 |
| oisf/suricata | ≥ 8.0.0, < 8.0.2 | 8.0.2 |