Numeric Truncation Error in Suricata - CVE-2026-63449
Published: July 22, 2026
Vulnerability identifier: #VU139038
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63449
CWE-ID: CWE-197
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to evade detection of SIP message body content.
The vulnerability exists due to numeric truncation error in the SIP parser when processing SIP messages with bodies larger than 65536 bytes. A remote attacker can send a specially crafted SIP message to evade detection of SIP message body content.
The issue affects inspection using the frame:request.body or frame:response.body keywords because the full body content is not included.
Affected software
Suricata
How to mitigate CVE-2026-63449
Install security update from vendor's website.
Suricata - update to 8.0.6