CVE-2026-63447 in Suricata
Summary
by MITRE • 09/19/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within Suricata versions ranging from 8.0.5 through 8.0.6 represents a critical flaw in the application-layer protocol parsing logic specifically targeting File Transfer Protocol traffic. As an Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, Suricata relies on efficient stateful inspection of network protocols to maintain visibility into network activities. The FTP parser located in the source file src/app-layer-ftp.c failed to enforce strict boundaries when processing large chunks of FTP command data. Specifically, the system continued allocating transaction structures even after the configured limit defined by app-layer.protocols.ftp.max-tx was exceeded during a single session. This behavior indicates a failure in input validation and state management, where the engine did not properly terminate or reset the transaction context upon reaching the maximum threshold for active transactions within that protocol stream.
The technical consequence of this oversight is severe performance degradation due to algorithmic inefficiency introduced by unbounded memory allocation. When the too_many_transactions event was triggered, rather than discarding excess data or resetting the state cleanly, Suricata retained an oversized list of transaction objects. Subsequent processing of this inflated dataset exhibited quadratic complexity relative to the number of transactions. In practical terms, as the volume of crafted FTP traffic increased, the computational resources required to process each packet grew exponentially rather than linearly. This creates a scenario where an attacker can induce significant CPU consumption and memory pressure by sending carefully constructed FTP commands that exploit this parsing logic flaw.
From an operational perspective, this vulnerability directly impacts the availability and reliability of network security monitoring infrastructure. The excessive resource utilization caused by quadratic processing complexity leads to packet drops, delayed alert generation, or complete service failure within the Suricata instance. This effectively results in a denial of service condition for the organization relying on the system for threat detection and prevention. Attackers can leverage this flaw to blind security operations centers to other malicious activities occurring concurrently with the FTP-based attack vector. The impact extends beyond mere performance loss; it compromises the integrity of network visibility, allowing potential intrusions or data exfiltration attempts via non-FTP channels to go undetected due to the overwhelmed monitoring engine.
This vulnerability is categorized under CWE-787 Out-of-bounds Write and CWE-400 Uncontrolled Resource Consumption within common weakness enumeration frameworks. The failure to limit transaction allocation aligns with principles of robust input handling, while the resulting performance degradation maps directly to resource exhaustion attacks. In terms of adversary tactics, this exploit technique corresponds to ATT&CK T1496 Network Service Scanning or more accurately T1498 Network Denial of Service, as it aims to disrupt service availability through computational overload rather than direct system compromise. The attack vector is classified as remote with low complexity, requiring only network access and the ability to send specific FTP packets to trigger the condition.
Mitigation for this vulnerability involves immediate upgrading to Suricata version 8.0.6 or later, where the parsing logic has been corrected to properly enforce transaction limits and prevent unbounded allocation. Organizations should also consider implementing rate limiting on FTP traffic at the network perimeter as a compensating control while patching is underway. Additionally, monitoring for unusual spikes in CPU usage associated with Suricata processes can serve as an early warning indicator of exploitation attempts. Regular updates to IDS/IPS engines are essential to maintain resilience against such application-layer parsing flaws that target core protocol handling mechanisms.