CVE-2025-64330

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OISF/suricata/commit/482e5eac9218d007adbe2410d6c00173368ce947	Patch
https://github.com/OISF/suricata/security/advisories/GHSA-83v7-gm34-f437	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oisf:suricata::::::::
	cpe:2.3:a:oisf:suricata::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Suricata es un motor IDS, IPS y NSM de red desarrollado por la OISF (Open Information Security Foundation) y la comunidad de Suricata. Versiones anteriores a la 7.0.13 y 8.0.2, un desbordamiento de montículo de lectura de un solo byte al registrar el veredicto en los registros eve.alert y eve.drop puede provocar caídas del sistema. Esto requiere que la cola de alertas por paquete se llene de alertas y luego sea seguida por una regla de paso. Este problema ha sido parcheado en las versiones 7.0.13 y 8.0.2. Para reducir la probabilidad de que ocurra este problema, el tamaño de la cola de alertas debe aumentarse (packet-alert-max en suricata.yaml) si el veredicto está habilitado.

Information

Published : 2025-11-26 23:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64330

Mitre link : CVE-2025-64330

CVE.ORG link : CVE-2025-64330

JSON object : View

Products Affected

oisf

suricata

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-64330", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64330", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-28T15:36:02.909817Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": "< 7.0.13"}, {"status": "affected", "version": "< 8.0.2"}]}]}], "published": "2025-11-26T23:15:48.093", "references": [{"url": "https://github.com/OISF/suricata/commit/482e5eac9218d007adbe2410d6c00173368ce947", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OISF/suricata/security/advisories/GHSA-83v7-gm34-f437", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled."}, {"lang": "es", "value": "Suricata es un motor IDS, IPS y NSM de red desarrollado por la OISF (Open Information Security Foundation) y la comunidad de Suricata. Versiones anteriores a la 7.0.13 y 8.0.2, un desbordamiento de mont\u00edculo de lectura de un solo byte al registrar el veredicto en los registros eve.alert y eve.drop puede provocar ca\u00eddas del sistema. Esto requiere que la cola de alertas por paquete se llene de alertas y luego sea seguida por una regla de paso. Este problema ha sido parcheado en las versiones 7.0.13 y 8.0.2. Para reducir la probabilidad de que ocurra este problema, el tama\u00f1o de la cola de alertas debe aumentarse (packet-alert-max en suricata.yaml) si el veredicto est\u00e1 habilitado."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA4D86E3-44A3-4B0B-9CF4-9FC88091D3C1", "versionEndExcluding": "7.0.13"}, {"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C93A731C-19AD-4067-B28C-17164C2D981D", "versionEndExcluding": "8.0.2", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}