Vulnerability record · CVE-2025-59150 · published 1 October 2025

CVE-2025-59150: Oisf suricata null pointer dereference vulnerability

Oisf · Suricata

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.

7.5 CVSS 3.1 High EPSS 0.53% · top 57.7% CWE-476 · NULL pointer dereference

7.5CVSS 3.1 base score

0.53%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Suricata Oisf

References

Link	Tags
https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018	Release Notes
https://github.com/OISF/suricata/commit/d590fdfe42e995fd558315f0c24f9a352e21479d	Patch
https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3	PatchThird Party Advisory
https://redmine.openinfosecfoundation.org/issues/7881	ExploitIssue TrackingVendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-detection-script
https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-mitigation-script

Track CVE-2025-59150 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-22262Oisf suricata stack-based buffer overflow vulnerabilitySuricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14,…EPSS 0.55%27 Jan 2026 9.8CVE-2023-35853Oisf suricata code injection vulnerabilityIn Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by …EPSS 1.0%19 Jun 2023 9.8CVE-2021-37592Oisf suricata out-of-bounds write vulnerabilitySuricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments.EPSS 1.6%19 Nov 2021 9.8CVE-2018-10244Oisf suricata integer overflow vulnerabilitySuricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated…EPSS 1.7%4 Apr 2019 9.1CVE-2026-45764Oisf suricata type confusion vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.…EPSS 0.63%10 Sep 2026 9.1CVE-2026-22264Oisf suricata use after free vulnerabilitySuricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free cond…EPSS 0.40%27 Jan 2026 9.1CVE-2019-18792Oisf suricata interpretation conflict vulnerabilityAn issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet…EPSS 2.5%6 Jan 2020 8.1CVE-2024-23839Oisf suricata use after free vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially craft…EPSS 0.78%26 Feb 2024

Source: NIST National Vulnerability Database (record CVE-2025-59150), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.