CVE-2025-29917: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64…

PriorityP421medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.22%

12.4th percentile

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	suricata	< suricata 1:7.0.9-1 (forky)	suricata 1:7.0.9-1 (forky)
oisf	suricata	< 7.0.9	7.0.9
oisf	suricata	>= 0 < 1:7.0.9-1	1:7.0.9-1
oisf	suricata	>= 0 < 1:7.0.9-1	1:7.0.9-1

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian6.2MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.