CVE-2026-63449CWE-197

CVE-2026-63449

Low · published September 19, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-197 · Numeric Truncation Error
Published
2026-09-19T01:17Z
Affected products (1)
ProductVersionsFixed in
oisf/suricata≥ 8.0.0, < 8.0.68.0.6
References (6)
https://github.com/OISF/suricata/commit/499995bf0e5eab34b647ec1024ce65d72c411816 · [email protected]https://github.com/OISF/suricata/commit/6f87930aff1e2294e46289cb9cbf4d96d79a209a · [email protected]https://github.com/OISF/suricata/pull/15807 · [email protected]https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 · [email protected]https://github.com/OISF/suricata/security/advisories/GHSA-prqx-q74v-wxhv · [email protected]https://redmine.openinfosecfoundation.org/issues/8582 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 18 SEP 20:12Z
    Suricata sip: large SIP message bodies can evade detection with frame keyword
    cvelistv5