GCVE - cpe:2.3:a:oisf:suricata:8.0.0:beta1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:oisf:suricata:8.0.0:beta1:*:*:*:*:*:*

part: a version: 8.0.0 update: beta1

Vendor	Oisf (`cd5e037f-1562-515c-af4f-7fdde1a9512b`)
Product	Suricata (`4997bdfc-e075-545a-b5bf-6c424b0d2e55`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/suricata`	purl2cpe	2026-06-01 10:17:52.125645
`pkg:deb/ubuntu/suricata`	purl2cpe	2026-06-01 10:17:52.125646
`pkg:github/oisf/suricata`	purl2cpe	2026-06-01 10:17:52.125648
`pkg:rpm/fedora/suricata`	purl2cpe	2026-06-01 10:17:52.125649
`pkg:rpm/opensuse/suricata`	purl2cpe	2026-06-01 10:17:52.125650

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-59149`	vulnerable	2026-06-08 07:35:20.053434	Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms MEDIUM (6.2) Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms. Published: 2025-10-01T20:07:44.042Z Updated: 2025-10-01T20:17:41.659Z Open on db.gcve.eu Reference links https://github.com/OISF/suricata/security/advisories/GHSA-vxcg-38x4-gj7j https://github.com/OISF/suricata/commit/38a2cba5c397002047d84645f5ab770ff88020e1 https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018 https://redmine.openinfosecfoundation.org/issues/7861	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-59148`	vulnerable	2026-06-08 07:35:20.052923	Suricata's improper use of entropy keyword can lead to a NULL-ptr deref HIGH (7.5) Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer. Published: 2025-10-01T19:51:27.388Z Updated: 2025-10-01T19:58:13.158Z Open on db.gcve.eu Reference links https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3 https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018 https://redmine.openinfosecfoundation.org/issues/7838	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-59147`	vulnerable	2026-06-08 07:35:20.049281	Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets HIGH (7.5) Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1. Published: 2025-10-01T19:27:55.639Z Updated: 2025-10-01T19:42:24.032Z Open on db.gcve.eu Reference links https://github.com/OISF/suricata/security/advisories/GHSA-v8hv-6v7x-4c2r https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53538`	vulnerable	2026-06-08 07:31:14.683567	Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation HIGH (7.5) Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0. Published: 2025-07-22T21:36:03.976Z Updated: 2025-07-23T18:32:21.856Z Open on db.gcve.eu Reference links https://github.com/OISF/suricata/security/advisories/GHSA-qrr7-crgj-cmh3 https://github.com/OISF/suricata/commit/1d6d331752e933c46aca0ae7a9679b27462246e3 https://github.com/OISF/suricata/commit/7fa88ea9e7d05e07a7864050cfd836b576669720	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.