OISF Suricata up to 8.0.0 null pointer dereference

Summaryinfo

A vulnerability identified as problematic has been detected in OISF Suricata up to 8.0.0. The impacted element is an unknown function. Performing a manipulation results in null pointer dereference. This vulnerability is known as CVE-2025-59148. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in OISF Suricata up to 8.0.0. This affects some unknown functionality. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on availability. The summary by CVE is:

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-59148 since 09/09/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 269722 (Suricata 8.0.0 < 8.0.1 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.0.1 eliminates this vulnerability. Applying the patch 9f32550e18f97ea5d610dd7c36aab0ba142c096c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (269722). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 8.0

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion