Numeric Truncation Error in Suricata - #VU162644
Published: November 9, 2026
Vulnerability identifier: #VU162644
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-197
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to hide certificate SubjectAltName entries from Suricata inspection and logging.
The vulnerability exists due to numeric truncation of the SubjectAltName count in Suricata's TLS certificate processing when a leaf certificate contains 65,536 or more entries. An unauthenticated remote attacker can present such a certificate over TLS 1.2 or earlier to conceal entries beyond the truncated count while the victim client receives the full list.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7