OISF Suricata up to 7.0.12/8.0.1 Decompression stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in OISF Suricata up to 7.0.12/8.0.1. Affected is an unknown function of the component Decompression Handler. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2025-64332. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OISF Suricata up to 7.0.12/8.0.1. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Decompression Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect availability. The summary by CVE is:

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling SWF decompression (swf-decompression in suricata.yaml), it is disabled by default; set decompress-depth to lower than half your stack size if swf-decompression must be enabled.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-64332 since 10/30/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276969 (Linux Distros Unpatched Vulnerability : CVE-2025-64332), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.0.13 or 8.0.2 eliminates this vulnerability. Applying the patch ad446c9006a77490af51c468aae0ce934f4d2117 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (276969). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 8.0.0
• 8.0.1

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion