CVE-2025-59149: 
Suricata vulnerability analysis and mitigation

CVE-2025-59149 is a stack-based buffer overflow vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine developed by OISF. It affects Suricata version 8.0.0 (including beta1 and rc1 pre-releases) and is triggered when rules using the ldap.responses.attribute_type keyword — which produces a long string — are combined with transforms, causing a stack buffer overflow during Suricata startup or rule reload. The vulnerability was published on September 30, 2025, and fixed in version 8.0.1. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is a stack-based buffer overflow (CWE-121) in Suricata's ShortenString() function located in src/util-misc.c. When the ldap.responses.attribute_type keyword — which generates a particularly long string — is used alongside rule transforms, the function fails to properly validate the output_size and half parameters before writing to the output buffer, resulting in a write beyond the allocated stack buffer. The fix, committed as 38a2cba, hardens the string shortener by adding boundary checks: it returns early if output_size is zero, and validates that half does not exceed output_size before proceeding (GitHub Commit, GitHub Advisory). The attack vector is local, as exploitation requires the ability to load or reload malicious rules into the Suricata engine.

Successful exploitation causes Suricata to crash during startup or rule reload, resulting in a complete loss of availability of the IDS/IPS/NSM engine (High availability impact). Because Suricata is a network security monitoring component, its crash leaves the monitored network without intrusion detection or prevention coverage, potentially allowing malicious traffic to pass undetected. There is no confidentiality or integrity impact reported (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-59149. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to load or trigger a rule reload with a crafted rule containing ldap.responses.attribute_type and transforms, limiting the practical attack surface (GitHub Advisory).

Users should upgrade Suricata to version 8.0.1, which contains the fix for this vulnerability. As a temporary workaround, administrators can disable any rules that use the ldap.responses.attribute_type keyword in combination with transforms to prevent the overflow from being triggered during startup or rule reload. The fix was released alongside Suricata 7.0.12 in the same release cycle (GitHub Advisory, Suricata Release).

The advisory was published by Suricata maintainer victorjulien on GitHub on September 30, 2025, and the fix was included in the Suricata 8.0.1 and 7.0.12 release announcement. Community discussion was noted on the Suricata forum and the Solus Linux distribution update post, indicating routine downstream packaging activity. No significant independent researcher commentary or media coverage has been identified beyond standard vulnerability database aggregation (Suricata Forum).