Vulnerability in Oisf Suricata
CVE-2025-29915
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
EPSS: 0.003 (17.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Oisf Suricata — versions < 7.0.9
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2025-29915?
- CVE-2025-29915 is a high-severity vulnerability in Oisf Suricata, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.5/10. Published 2025-04-10.
- How severe is CVE-2025-29915?
- High severity. CVSS v3 base score is 7.5 out of 10.