CVE-2026-63447

Published: Sep 18, 2026Modified: Sep 28, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.

Affected (1)

Products: Oisf: Suricata

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oisf Suricata	Version 8.0.5

Related CWEs

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (5)

https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385

Source: security-advisories@github.com

Patch

https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5

Source: security-advisories@github.com

Patch

https://github.com/OISF/suricata/releases/tag/suricata-8.0.6

Source: security-advisories@github.com

Release Notes

https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9

Source: security-advisories@github.com

MitigationVendor Advisory

https://redmine.openinfosecfoundation.org/issues/8592

Source: security-advisories@github.com

Permissions Required

Timeline

No history available yet.