Allocation of Resources Without Limits or Throttling in Suricata - #VU162645
Published: November 9, 2026
Vulnerability identifier: #VU162645
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause Suricata to drop RFB event records.
The vulnerability exists due to missing per-field length limits for server-controlled desktop names and security-failure reasons in the RFB parser. An unauthenticated remote attacker can supply strings containing control bytes whose JSON escaping expands records beyond the EVE buffer limit, causing event loss when RFB parsing and logging are enabled and stream.reassembly.depth permits sufficiently large fields.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7