OISF Suricata up to 7.0.12/8.0.1 HTTP File Transfer stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in OISF Suricata up to 7.0.12/8.0.1. The affected element is an unknown function of the component HTTP File Transfer Handler. Executing a manipulation can lead to stack-based overflow. This vulnerability appears as CVE-2025-64331. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in OISF Suricata up to 7.0.12/8.0.1. This vulnerability affects an unknown part of the component HTTP File Transfer Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect availability. CVE summarizes:

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow can occur on large HTTP file transfers if the user has increased the HTTP response body limit and enabled the logging of printable http bodies. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves using default HTTP response body limits and/or disabling http-body-printable logging; body logging is disabled by default.

The advisory is available at github.com. This vulnerability was named CVE-2025-64331 since 10/30/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 276967 (Linux Distros Unpatched Vulnerability : CVE-2025-64331), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.0.13 or 8.0.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276967). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 8.0.0
• 8.0.1

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion