CVE-2026-63447
published 2026-09-18CVE-2026-63447: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.63%
49.5th percentile
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | — | — |
| oisf | suricata | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
suricata: suricata: Denial of Service via crafted FTP traffic
vendor_redhat·2026-09-18·CVSS 7.5
CVE-2026-63447 [HIGH] CWE-770 suricata: suricata: Denial of Service via crafted FTP traffic
suricata: suricata: Denial of Service via crafted FTP traffic
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
A flaw was found in Suricata. A remote, unauthenticated attacker can exploit this issue by sending specially crafted File Transfer Protocol (F
VulDB
OISF Suricata up to 8.0.5 FTP Parser src/app-layer-ftp.c resource consumption
vuldb·2026-09-18·CVSS 7.5
CVE-2026-63447 [HIGH] OISF Suricata up to 8.0.5 FTP Parser src/app-layer-ftp.c resource consumption
A vulnerability, which was classified as critical, has been found in OISF Suricata up to 8.0.5. The impacted element is an unknown function of the file src/app-layer-ftp.c of the component FTP Parser. This manipulation causes resource consumption.
This vulnerability is handled as CVE-2026-63447. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5https://github.com/OISF/suricata/releases/tag/suricata-8.0.6https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9https://redmine.openinfosecfoundation.org/issues/8592
2026-09-18
Published