High severity · published Feb 26, 2024
CVE-2024-23836
crafted traffic can cause denial of service
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
suricata · OISF
< 6.0.16; >= 7.0.0, < 7.0.3 · source: vendor, NVD
FE
Fedora · Fedoraproject
38; 39 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23836
Patch
https://github.com/OISF/suricata/commit/18841a58da71e735ddf4e52cbfa6989755ecbeb7
Patch
https://github.com/OISF/suricata/commit/2a2120ecf10c5b5713ec2bf59469fe57f7b5b747
Patch
https://github.com/OISF/suricata/commit/83c5567ea7b0b28376f57dcfee9c6301448c7bc7
Patch
https://github.com/OISF/suricata/commit/8efaebe293e2a74c8e323fa85a6f5fadf82801bc
Patch
https://github.com/OISF/suricata/commit/97953998d2d60673ed6c30ddfb6a2d59b4230f97
Patch
https://github.com/OISF/suricata/commit/b1549e930f6426eeff43f12b672337cbcda566b8
More from suricata
9.8
CVE-2026-22262
Suricata datasets: stack overflow when saving a set
9.8
CVE-2023-35853
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code
9.8
CVE-2021-37592
Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments
9.8
CVE-2018-10244
Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU
9.4
CVE-2026-94084
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform
