CVE-2026-63450 in Suricata
Summary
by MITRE • 09/18/2026
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Suricata serves as a critical component in modern network security architectures, functioning simultaneously as an Intrusion Detection System, an Intrusion Prevention System, and a Network Security Monitoring engine. Its effectiveness relies heavily on the accurate parsing of application-layer protocols to detect malicious activity or enforce policy compliance. Within this framework, the File Transfer Protocol parser located in the source file src/app-layer-ftp.c plays a pivotal role in interpreting FTP traffic. The vulnerability identified prior to version 8.0.6 stems from an incorrect handling of protocol state transitions when commands are issued out of sequence relative to standard negotiation procedures. Specifically, if a client sends a RETR or STOR command before completing the PORT or PASV data channel negotiation phase, the parser incorrectly classifies this as a fatal application-layer error rather than recognizing it as a recoverable protocol event that should be handled with appropriate state management.
This misclassification triggers a severe operational consequence where the FTP application-layer parsing is disabled for the remainder of the TCP flow. In practical terms, once the parser enters this failed state, Suricata ceases to inspect subsequent commands within that connection stream. This creates a significant blind spot in network security monitoring because any malicious activity occurring after the initial malformed command will not be analyzed by protocol-aware rules. Consequently, attackers can exploit this behavior to evade detection mechanisms that rely on deep packet inspection of FTP traffic. The parser effectively ignores later commands, allowing potentially harmful data transfers or administrative actions to proceed without triggering alerts or logging events as expected.
The impact varies depending on the operational mode in which Suricata is deployed. In Intrusion Detection System mode, the primary risk is a loss of visibility and audit trail integrity, as subsequent malicious activities remain unlogged and undetected by rule-based signatures. This undermines the organization's ability to monitor for data exfiltration or unauthorized file access via FTP. In Intrusion Prevention System mode, the consequences are more immediate but potentially disruptive; instead of merely ignoring later commands, Suricata drops the entire TCP flow. While this prevents further communication on that connection, it can lead to denial-of-service conditions for legitimate users if their connections are inadvertently terminated due to a single malformed command from an attacker or even a misconfigured client application.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to correctly validate the sequence of protocol commands and mishandles exceptional states by transitioning to a fatal error rather than recovering gracefully. From an offensive perspective, this flaw can be leveraged using techniques associated with ATT&CK T1071 Application Layer Protocol, specifically within FTP communications, where adversaries manipulate protocol state machines to bypass security controls. The exploitation involves sending out-of-sequence commands to force the parser into a disabled state, thereby creating a window of opportunity for undetected data transfer or command execution.
The issue was resolved in Suricata version 8.0.6 by correcting the logic within the FTP parser to treat such sequence violations as recoverable events rather than fatal errors. This ensures that parsing continues normally even if commands are issued before full negotiation, maintaining both visibility and connection stability. Organizations running versions prior to 8.0.6 should prioritize upgrading immediately to restore proper protocol inspection capabilities and prevent potential evasion of security policies. Additionally, administrators should review their FTP server configurations to ensure strict adherence to RFC standards regarding command sequencing, although the primary mitigation remains updating the Suricata software itself to patch this specific parsing flaw.