VulnerabilityAnalyzed

CVE-2025-29916

Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation.

MEDIUM 5.5EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-770
Affected: oisf/suricata
Source: security-advisories@github.com

References

https://github.com/OISF/suricata/commit/a7713db709b8a0be5fc5e5809ab58e9b14a16e85Patch
https://github.com/OISF/suricata/security/advisories/GHSA-27g3-pmvp-j9cvVendor Advisory
https://redmine.openinfosecfoundation.org/issues/7615Permissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.