Search

CVE-2026-63446 - Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

CVE ID : CVE-2026-63446 Published : Sept. 18, 2026, 8:22 p. m. • 34 minutes ago Description : Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8. 0. 0 until 8. 0. 6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser. c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8. 0. 6. Severity: 0.0 • NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...