Vulnerability in Oisf Suricata
CVE-2025-29915
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (17.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 17.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Oisf Suricata — versions < 7.0.9
Weakness classification (CWE)
References
- github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp (Issue Tracking, Vendor Advisory)
- github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d (Patch)
- redmine.openinfosecfoundation.org/issues/5373 (Issue Tracking)
Frequently asked questions
- What is CVE-2025-29915?
- CVE-2025-29915 is a high-severity vulnerability in Oisf Suricata, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.5/10. Published 2025-04-10.
- How severe is CVE-2025-29915?
- High severity. CVSS v3 base score is 7.5 out of 10.