CVE-2025-59148: 
Suricata vulnerability analysis and mitigation

CVE-2025-59148 is a NULL pointer dereference vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine developed by OISF. The flaw affects Suricata version 8.0.0 (including release candidates 8.0.0-rc1 and 8.0.0-beta1) and arises from incorrect handling of the entropy keyword when it is not anchored to a "sticky" buffer, which can trigger a segmentation fault. The vulnerability was published on September 30, 2025, and fixed in version 8.0.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in Suricata's entropy detection logic. When the entropy keyword is used in a detection rule without being anchored to a sticky buffer, the DetectEntropyDoMatch function attempts to call FlowVarAddFloat using det_ctx->p->flow, which can be NULL in that code path, causing a segmentation fault. The fix, committed in GitHub Commit, passes the flow pointer explicitly to DetectEntropyDoMatch and guards the FlowVarAddFloat call with a NULL check (if (flow && entropy != -1.0)). Additionally, the fix registers a flow variable for the non-sticky-buffer case, ensuring the entropy matcher has a valid flow context regardless of rule configuration (GitHub Advisory, GitHub Commit).

Successful exploitation causes Suricata to crash with a segmentation fault, resulting in a denial of service condition that disables network intrusion detection and prevention capabilities. Because Suricata functions as a critical security control, its crash could leave monitored network segments without IDS/IPS coverage, potentially allowing malicious traffic to pass undetected. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability can be triggered remotely without authentication or user interaction by sending network traffic that causes a rule with an improperly configured entropy keyword to be evaluated. The EPSS score is approximately 0.048%, indicating a low probability of exploitation in the near term. CVE-2025-59148 is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

• Process: Suricata process terminating unexpectedly with a segmentation fault (SIGSEGV); core dump files generated in the Suricata working directory.
• Logs: Suricata log entries showing a crash or unexpected restart; system logs (e.g., /var/log/syslog or journalctl) recording a segfault for the suricata process.
• Network: Absence of Suricata alert or event output (e.g., eve.json stops being written) following receipt of specific network traffic, indicating the engine has crashed.

Upgrade Suricata to version 8.0.1, which contains the official fix (GitHub Advisory). If an immediate upgrade is not possible, two workarounds are available: (1) disable all detection rules that use the entropy keyword, or (2) audit existing rules to ensure every use of the entropy keyword is anchored to a sticky buffer. Organizations running Suricata 8.0.0 in IPS mode should prioritize patching, as a crash in that mode would also interrupt inline traffic blocking (Red Hat Bugzilla).

The Suricata project published a GitHub Security Advisory (GHSA-5qf6-92xg-3rr3) on September 30, 2025, and released the patched version 8.0.1 alongside 7.0.12 on September 16, 2025. Red Hat tracked the issue via Bugzilla and assigned it high severity. No significant independent researcher commentary or broad social media discussion has been identified beyond standard CVE aggregator coverage (GitHub Advisory, Suricata Release).