Always-Incorrect Control Flow Implementation in Suricata - #VU162650
Published: November 9, 2026
Vulnerability identifier: #VU162650
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-670
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause spurious alerts and unintended file storage in Suricata.
The vulnerability exists due to skipped leading file keyword constraints when Suricata inspects the second and later files in crafted multi-file transactions using rules with multiple file keywords. An unauthenticated remote attacker can submit such transactions to generate incorrect matches and store excluded files when file storage is enabled and filestore is the trailing keyword.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7