Uncontrolled Recursion in Suricata - #VU162658
Published: November 9, 2026
Vulnerability identifier: #VU162658
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to terminate Suricata and cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the LDAP parser when processing requests containing deeply nested filters, with LDAP parsing enabled by default. An unauthenticated remote attacker can send a crafted LDAP request through traffic inspected by Suricata to exhaust a packet-processing thread's stack and crash the process.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7