Uncontrolled Recursion in Suricata - #VU162649
Published: November 9, 2026
Vulnerability identifier: #VU162649
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to terminate Suricata and cause denial of service on deployments with sufficiently small worker stacks.
The vulnerability exists due to uncontrolled recursion in Suricata's IKE application-layer parser when processing deeply nested IKEv1 payloads. An unauthenticated remote attacker can send a crafted IKEv1 datagram through traffic inspected by the parser to overflow a packet-processing thread's stack.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7