CyberRota Analysis
AI-GeneratedSuricata versions prior to 7.0.17 and 8.0.6 are vulnerable to a flaw in flow handling that allows IPv4 and IPv6 packets to be treated as equivalent, potentially leading to incorrect flowbit states and detection bypasses. This vulnerability could compromise network security monitoring and intrusion detection effectiveness. Organizations using affected Suricata versions should prioritize upgrading to the patched versions to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Related CVEs
Other vulnerabilities affecting the same vendor(s)