CVE-2026-63446 - Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
Brief
CVE ID : CVE-2026-63446
Published : Sept. 18, 2026, 8:22 p. m.
- 34 minutes ago
Description : Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.
- 0 until 8.
- 6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser. c uses an inverted guard and marks only already-inspected transactions as inspected.
On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.
- 6.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...