CVE-2025-64333: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13…

PriorityP343high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.28%

19.5th percentile

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a large HTTP content type, when logged can cause a stack overflow crashing Suricata. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves limiting stream.reassembly.depth to less then half the stack size. Increasing the process stack size makes it less likely the bug will trigger.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	suricata	< suricata 1:8.0.2-1 (forky)	suricata 1:8.0.2-1 (forky)
oisf	suricata	< 8.0.2	8.0.2
oisf	suricata	< 7.0.13	7.0.13
oisf	suricata	>= 0 < 1:7.0.10-1+deb13u2	1:7.0.10-1+deb13u2
oisf	suricata	>= 0 < 1:8.0.2-1	1:8.0.2-1
oisf	suricata	>= 8.0.0 < 8.0.2	8.0.2

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv7.5HIGH

vendor_debian7.5HIGH

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.