OISF Suricata up to 7.0.8 hashsize allocation of resources

Summaryinfo

A vulnerability identified as problematic has been detected in OISF Suricata up to 7.0.8. This affects an unknown function of the component hashsize Handler. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2025-29916. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in OISF Suricata up to 7.0.8 and classified as problematic. Affected by this vulnerability is some unknown functionality of the component hashsize Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-29916 since 03/12/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233809 (Fedora 41 : suricata (2025-5fa61dc843)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.0.9 eliminates this vulnerability. Applying the patch a7713db709b8a0be5fc5e5809ab58e9b14a16e85 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (233809) and CERT Bund (WID-SEC-2025-1850). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Xerox FreeFlow Print Server

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion