Improper access control in Suricata - #VU162652
Published: November 9, 2026
Vulnerability identifier: #VU162652
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to truncate Suricata's inspection of decompressed SWF content and potentially evade file rules.
The vulnerability exists due to attacker-controlled SWF FileLength values limiting inspection of HTTP/1 response bodies when SWF decompression is enabled, with some affected releases additionally requiring decompress-depth: 0. An unauthenticated remote attacker can send a crafted CWS or ZWS response that causes content beyond the truncated output to escape inspection.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7