Interpretation Conflict in Suricata - #VU162667
Published: November 9, 2026
Vulnerability identifier: #VU162667
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to evade PostgreSQL traffic inspection and logging by Suricata.
The vulnerability exists due to Suricata's PostgreSQL parser, enabled by default, ignoring declared CopyInResponse and CopyOutResponse message lengths and consuming bytes according to an attacker-controlled column count. An unauthenticated remote attacker can send crafted PostgreSQL responses to desynchronize Suricata's interpretation of the traffic and hide subsequent messages from inspection rules and EVE logging.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7