CVE-2026-63446 in Suricata
Summary
by MITRE • 09/19/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within Suricata versions ranging from 8.0.0 to 8.0.6 represents a critical logic error in the application layer parsing subsystem that leads to severe resource exhaustion and potential denial of service conditions for network security infrastructure. Suricata operates as a high-performance Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, relying heavily on efficient state management to track network flows and transactions. The core flaw resides specifically within the AppLayerParserSetTransactionInspectId function located in the src/app-layer-parser.c source file. This component is responsible for tracking which application layer transactions have already undergone inspection by detection rulesets, a mechanism essential for preventing redundant processing and ensuring accurate alerting without duplicate notifications.
The technical root cause of this vulnerability is an inverted logical guard within the AppLayerParserSetTransactionInspectId function. In normal operation, this function should mark newly inspected transactions to indicate that they have been processed, thereby allowing the system to skip them in subsequent passes over the same flow data. However, due to the inversion error, the logic incorrectly marks only those transactions that were already previously inspected as inspected. Consequently, for flows governed by pass rules or pass-the-flow exception policies where detection is intentionally skipped, completed transactions remain unmarked because they never entered the standard inspection path. This failure to mark these specific transactions creates a state inconsistency where the system believes these transactions are still pending inspection despite having been processed or bypassed in prior cycles.
This logical error triggers a cascading effect on memory management and CPU utilization within the Suricata engine. Because completed transactions associated with pass-rule flows remain unmarked, they persist in the per-flow transaction list indefinitely rather than being freed from memory. As new traffic continues to flow through these affected connections, additional incomplete or redundant entries accumulate without bound. The system is forced to repeatedly rescans this ever-growing list of transactions during subsequent inspection cycles. This results in a quadratic cleanup cost relative to the number of unmarked transactions, meaning that as the list grows linearly with incoming traffic volume, the computational effort required to process and clean up these items increases exponentially.
The operational impact of this vulnerability is significant for any organization deploying Suricata versions 8.0.0 through 8.0.6 in environments where pass rules or exception policies are utilized. The unbounded growth of transaction lists leads directly to excessive memory consumption, which can eventually cause the application to crash due to out-of-memory conditions. Simultaneously, the quadratic CPU overhead from repeatedly rescanning and cleaning up these stale entries degrades overall system performance, potentially causing packet drops in high-throughput environments or rendering the IDS/IPS engine ineffective as a real-time security monitoring tool. This scenario aligns with CWE-401, which describes missing release of memory after effective usage, and contributes to resource exhaustion vulnerabilities often categorized under CWE-789 regarding uncontrolled memory consumption.
From an offensive perspective, this vulnerability could be leveraged by attackers aiming to disrupt network visibility or cause denial of service against the security monitoring infrastructure itself. By generating traffic that triggers pass-rule exceptions while maintaining active connections, an attacker can force the Suricata engine into a state of continuous high CPU usage and memory allocation until it becomes unresponsive. This aligns with MITRE ATT&CK techniques related to Resource Hijacking or Denial of Service against network services, specifically targeting the availability component of security controls. The ability to degrade the performance of an IDS/IPS system effectively blinds defenders to other malicious activities occurring on the same network segment during the period of degradation.
The recommended mitigation is straightforward and involves upgrading Suricata to version 8.0.6 or later, where this logical inversion has been corrected in the source code. Administrators should verify their deployment versions immediately if they are utilizing pass rules or exception policies that bypass detection for specific flows. In addition to patching, organizations should monitor system resource usage metrics such as memory consumption and CPU load on hosts running Suricata to detect any anomalous spikes that might indicate exploitation of this flaw in unpatched environments. Ensuring strict version control and regular updates are part of the vulnerability management lifecycle is critical to maintaining the integrity and availability of network security monitoring capabilities against known logic errors in open-source security tools.