← Vulnerability feed

Vulnerability record · CVE-2026-63447 · published 18 September 2026

CVE-2026-63447: Oisf suricata vulnerability

Oisf · Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.

7.5 CVSS 3.1 High EPSS 0.63% · top 51.9% CWE-407 · CWE-407
7.5CVSS 3.1 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
28 Sep 2026Last modified by NVD

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385 Patch
https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5 Patch
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 Release Notes
https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9 MitigationVendor Advisory
https://redmine.openinfosecfoundation.org/issues/8592 Permissions Required

Track CVE-2026-63447 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-22262Oisf suricata stack-based buffer overflow vulnerabilitySuricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14,…EPSS 0.55%9.8CVE-2023-35853Oisf suricata code injection vulnerabilityIn Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by …EPSS 1.0%9.8CVE-2021-37592Oisf suricata out-of-bounds write vulnerabilitySuricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of segments.EPSS 1.6%9.8CVE-2018-10244Oisf suricata integer overflow vulnerabilitySuricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated…EPSS 1.7%9.4CVE-2026-94083Oisf suricata type confusion vulnerabilitySuricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the …EPSS 0.54%9.4CVE-2026-94084Oisf suricata use after free vulnerabilitySuricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and witho…EPSS 0.54%9.1CVE-2026-45764Oisf suricata type confusion vulnerabilitySuricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.…EPSS 0.63%9.1CVE-2026-22264Oisf suricata use after free vulnerabilitySuricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free cond…EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2026-63447), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.