Resource exhaustion in Oisf Suricata
CVE-2024-23836
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.012 (66.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Oisf Suricata — versions < 6.0.16, >= 7.0.0, < 7.0.3
- Fedoraproject Fedora — versions 38, 39
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/OISF/suricata/security/advisories/GHSA-q33q-45cr-3cpc (Vendor Advisory)
- github.com/OISF/suricata/commit/18841a58da71e735ddf4e52cbfa6989755ecbeb7 (Patch)
- github.com/OISF/suricata/commit/2a2120ecf10c5b5713ec2bf59469fe57f7b5b747 (Patch)
- github.com/OISF/suricata/commit/83c5567ea7b0b28376f57dcfee9c6301448c7bc7 (Patch)
- github.com/OISF/suricata/commit/8efaebe293e2a74c8e323fa85a6f5fadf82801bc (Patch)
- github.com/OISF/suricata/commit/97953998d2d60673ed6c30ddfb6a2d59b4230f97 (Patch)
- github.com/OISF/suricata/commit/b1549e930f6426eeff43f12b672337cbcda566b8 (Patch)
- github.com/OISF/suricata/commit/cd035d59e3df157b606f4fe67324ea8e437be786 (Patch)
- github.com/OISF/suricata/commit/ce9b90326949c94a46611d6394e28600ee5e8bd5 (Patch)
- github.com/OISF/suricata/commit/e7e28822f473320658d6125f16ac3f0524baff01 (Patch)
Frequently asked questions
- What is CVE-2024-23836?
- CVE-2024-23836 is a high-severity vulnerability in Oisf Suricata, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2024-02-26.
- How severe is CVE-2024-23836?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-23836 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.