CVE-2026-63448: CWE-400: Uncontrolled Resource Consumption in OISF suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
AI Analysis
Technical Summary
Suricata versions before 7.0.17 and 8.0.6 have a vulnerability in the SMB parser where force-completed transactions are retained on flows with payload in only one direction, including asynchronous one-sided flows. Cleanup waits for inspection in the unseen direction, causing the transaction creation paths in rust/src/smb to exceed the SMB_MAX_TX bound. This leads to repeated scanning of a growing list and unbounded per-flow state, resulting in CPU and memory exhaustion under sustained one-directional SMB traffic. The issue is addressed in Suricata versions 7.0.17 and 8.0.6.
Potential Impact
An attacker can cause Suricata to consume excessive CPU and memory resources by sending sustained one-directional SMB traffic, leading to denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in Suricata versions 7.0.17 and 8.0.6. Users should upgrade to these versions or later to remediate the issue. No other mitigation or workaround is indicated.
CVE-2026-63448: CWE-400: Uncontrolled Resource Consumption in OISF suricata
Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
CVSS v3.1
Score 5.9medium
Affected software
OISF
suricata
pkg:github/oisf/suricataRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Suricata versions before 7.0.17 and 8.0.6 have a vulnerability in the SMB parser where force-completed transactions are retained on flows with payload in only one direction, including asynchronous one-sided flows. Cleanup waits for inspection in the unseen direction, causing the transaction creation paths in rust/src/smb to exceed the SMB_MAX_TX bound. This leads to repeated scanning of a growing list and unbounded per-flow state, resulting in CPU and memory exhaustion under sustained one-directional SMB traffic. The issue is addressed in Suricata versions 7.0.17 and 8.0.6.
Potential Impact
An attacker can cause Suricata to consume excessive CPU and memory resources by sending sustained one-directional SMB traffic, leading to denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in Suricata versions 7.0.17 and 8.0.6. Users should upgrade to these versions or later to remediate the issue. No other mitigation or workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-16T19:35:57.767Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad9fc955bf5e2cf583e40a
Added to database: 09/18/2026, 20:32:09 UTC
Last enriched: 09/18/2026, 20:47:14 UTC
Last updated: 09/19/2026, 01:54:22 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.