Interpretation Conflict in Suricata - #VU162643
Published: November 9, 2026
Vulnerability identifier: #VU162643
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass DHCP detection and suppress default DHCP EVE logging in Suricata.
The vulnerability exists due to an interpretation conflict in Suricata's DHCP option parser when a valid Pad byte begins the option block. An unauthenticated remote attacker can send crafted DHCP traffic that endpoints process normally while Suricata omits intended DHCP fields and fails to match lease, renewal, and rebinding time rules.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7