CVE-2025-59147: 
Suricata vulnerability analysis and mitigation

Suricata versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. This vulnerability (CVE-2025-59147) was discovered in September 2025 and has been assigned a CVSS score of 7.5 (High) (Ubuntu CVE, Suricata Advisory).

The vulnerability occurs when multiple SYN packets with different sequence numbers are sent within the same flow tuple. This causes Suricata to improperly handle the TCP session establishment, specifically in the SYN and SYN/ACK retransmission handling. The issue affects the TCP stream processing module and its ability to properly track TCP sessions (Suricata Commit).

In IDS (Intrusion Detection System) mode, this vulnerability can lead to detection and logging bypass, allowing malicious traffic to go undetected. In IPS (Intrusion Prevention System) mode, it results in the flow getting blocked, potentially causing service disruption (Suricata Advisory).

The vulnerability has been fixed in Suricata versions 7.0.12 and 8.0.1. Users are strongly advised to upgrade to these patched versions. No workarounds are available for unpatched systems (Suricata Forum).