CVE-2025-64333: 
Suricata vulnerability analysis and mitigation

CVE-2025-64333 is a stack-based buffer overflow vulnerability in the Suricata network IDS, IPS, and NSM engine that allows remote unauthenticated attackers to crash the Suricata process by sending HTTP requests with oversized content-type headers. It affects all Suricata versions prior to 7.0.13 and versions 8.0.0 through 8.0.1 (prior to 8.0.2). The vulnerability was published on November 26, 2025, and patched versions were released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a stack-based buffer overflow (CWE-121 / CWE-787) triggered when Suricata's EVE JSON logging subsystem processes and logs an HTTP response or request with an abnormally large Content-Type header value. The overflow occurs on the stack during the logging operation, which can exhaust available stack space and crash the process. No authentication or user interaction is required — an attacker only needs to send a crafted HTTP request to a host monitored by a vulnerable Suricata instance. The issue is tracked upstream in the OISF Redmine issue tracker (#8056) (GitHub Advisory).

Successful exploitation causes a denial of service (DoS) by crashing the Suricata process, which disables network intrusion detection and prevention capabilities for the duration of the outage. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. In environments where Suricata operates in inline IPS mode, a crash could also allow malicious traffic to pass uninspected, effectively blinding the network security monitoring stack (GitHub Advisory, Red Hat Bugzilla).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.04%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detectable via Nessus plugin 276956.

1. Reconnaissance: Identify network segments or hosts monitored by a Suricata IDS/IPS instance running a version prior to 7.0.13 or 8.0.0–8.0.1.
2. Craft malicious HTTP request: Construct an HTTP request (or response, depending on traffic direction monitored) containing an extremely large Content-Type header value — large enough to overflow the stack buffer used during EVE JSON logging.
3. Transmit the request: Send the crafted HTTP request to any web server or endpoint whose traffic is inspected by the vulnerable Suricata sensor. No authentication to Suricata itself is required.
4. Trigger stack overflow: When Suricata processes and attempts to log the oversized Content-Type value, the stack-based buffer overflow is triggered, causing the Suricata process to crash.
5. Achieve DoS: The Suricata process terminates, disabling IDS/IPS monitoring until the service is manually restarted or auto-restarted by a watchdog (GitHub Advisory).

• Network: HTTP requests or responses with abnormally large (multi-kilobyte or larger) Content-Type header values traversing monitored network segments.
• Logs: Suricata process crash logs or core dump files generated around the time of suspicious HTTP traffic; absence of EVE JSON log entries following a period of expected traffic.
• Process: Unexpected termination of the suricata process (exit code indicating segmentation fault or stack overflow); repeated Suricata restarts logged by the system init/service manager (e.g., systemd showing suricata.service entering failed state).
• File System: Core dump files (e.g., core, suricata.core) in the Suricata working directory or system core dump location following a crash event.

Upgrade Suricata to version 7.0.13 (for the 7.x branch) or 8.0.2 (for the 8.x branch), which contain the official fix (GitHub Advisory). As a temporary workaround, limit stream.reassembly.depth in the Suricata configuration to less than half the process stack size, which reduces the likelihood of the overflow being triggered. Additionally, increasing the process stack size (e.g., via ulimit -s or systemd LimitSTACK) makes the bug less likely to trigger but does not eliminate it. Monitoring for abnormal HTTP Content-Type header sizes at a perimeter firewall or WAF can provide an additional layer of defense.

The Suricata project announced the patched releases (7.0.13 and 8.0.2) via the official Suricata forum and website on November 6, 2025, with the CVE formally published on November 26, 2025 (Suricata Release). Red Hat tracked the issue via Bugzilla and rated it high severity (Red Hat Bugzilla). CISA included the vulnerability in its weekly vulnerability bulletin for the week of November 24, 2025. Debian also issued a related news item in January 2026. Community reaction has been measured, consistent with the limited exploitation risk and straightforward remediation path.