suricata
8.0.8Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
- Maintenance
- Active312 commits in 3 months · bus factor 2
- License
- GPL-2.0Copyleft · OSI-approved
- Security
- 30 advisories4 high, 18 medium, 8 low · Scorecard 8.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
6.9k stars · 1.8k forks · 92 open issues · last release 16 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 4 high, 18 medium, 8 low. Check the patched version against the one you run.
- highGHSA-x7c3-ph72-6v2mSep 29, 2026lua/smtp: crafted MIME headers can cause an infinite loop in get_mime_list
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-m237-fp8w-4rhwSep 29, 2026nfs: optional NFSv3 READ attributes can bypass file-data inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- highGHSA-cwwv-p974-wgx8Sep 29, 2026enip: repeated CIP offsets can cause excessive CPU and memory consumption
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-vm2h-3c82-73fxSep 29, 2026ftp: memuse accounting leak can disable FTP inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-mwvg-xm2v-w8wrSep 29, 2026datasets: undersized hash entries can cause a heap buffer over-read
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-4668-j876-3qhrSep 29, 2026lua: incompatible userdata passed to object methods can crash Suricata
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-jvwh-7qpr-2hqvSep 29, 2026detect/pcre: flow-variable capture on flowless packets can crash Suricata
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-2w9q-8w29-hqjvSep 29, 2026ftp: overlong control lines can desynchronize command inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-8crg-r47r-h67cSep 29, 2026lua/dns: crafted DNS OPT answers can corrupt memory in Lua scripts
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-pm8c-xffr-83g2Sep 29, 2026dns: TCP gap resynchronization failure can disable per-flow inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-fqgq-f8wp-m94rSep 29, 2026dnp3: variable-length object fields can cause excessive memory allocation
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- highGHSA-cjhc-77qm-hw4mSep 29, 2026flow: ESP SPI excluded from flow hash enables algorithmic-complexity DoS
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-j2m9-52mr-vc27Sep 29, 2026defrag/ipv6: maximum-size reassembled packets can bypass inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-rpfg-rrr2-vvx3Sep 29, 2026lua/hashlib: using a hasher after finalization can crash Suricata
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-cw43-p5wx-66jvSep 29, 2026smtp: file-open failure can cause a NULL-pointer dereference
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-6q8w-q9j9-j4h7Sep 29, 2026enip: incomplete TCP PDUs can disable application-layer inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-cx5h-c976-qrpmSep 29, 2026nfs: SECINFO_NO_NAME replies can desynchronize NFSv4 inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-25g8-57pv-f9prSep 29, 2026lua/flowvar: unvalidated script length can cause out-of-bounds memory access
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-rch7-rh2f-287wSep 29, 2026detect: flowbits post-match candidates can overflow a heap buffer
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-gqq5-xc2p-x395Sep 29, 2026ssl: malformed SSLv2 CLIENT_HELLO can desynchronize TLS inspection
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-886c-wqx9-36w4Sep 29, 2026http1: unbounded number of anomalies can cause memory exhaustion
- Affected
- >= 8.0.0, < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-6hx8-qj6x-mm7wSep 29, 2026pcap-log: oversized conditional segment dumps can expose heap memory
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-rvm5-vgrc-j5rxSep 29, 2026detect: oversized inspection buffers can stall worker threads
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-4fw5-37cm-4jchSep 29, 2026detect/bytejump: variable nbytes can cause an out-of-bounds read
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-rhrq-pjxv-qmx9Sep 29, 2026datasets: forward-slash traversal can escape the data directory on Windows
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-483m-w85v-p9h4Sep 29, 2026stream/tcp: SYN retransmission can cause an inspection bypass
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-4v2c-vqvp-pgpfSep 29, 2026tcp-data/http-body-data: output file errors can terminate Suricata
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- lowGHSA-hp93-w62p-737xSep 29, 2026detect/byte_test: runtime nbytes can cause a heap out-of-bounds read
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- mediumGHSA-5w8v-x93r-57g5Sep 29, 2026detect/file: multi-file transactions can skip file keyword constraints
- Affected
- < 8.0.7
- Patched in
- 8.0.7
- highGHSA-74mf-g732-g3cvSep 29, 2026ike: deeply nested IKEv1 payloads can exhaust the worker stack
- Affected
- < 8.0.7
- Patched in
- 8.0.7