Executive brief
Suricata is a network security monitoring and intrusion detection system used to identify and block malicious traffic. A bug in its packet reassembly logic allows an attacker to send specially crafted fragmented network packets that crash the system, causing it to stop monitoring network traffic. This creates a brief window where attacks could go undetected.
Technical details
Suricata's IP defragmentation module failed to validate that a cached defragmentation tracker used the same IP address family (IPv4 or IPv6) as the current packet being processed. An attacker can send a sequence of crafted IPv4/IPv6 fragmented packets that cause an IPv6 fragment to be incorrectly associated with an IPv4 defragmentation tracker. When Suricata attempts to reassemble these mismatched fragments, the type confusion results in a remote, unauthenticated, crash. The attack is network-reachable with no privileges or user interaction required. Patches are available in versions 7.0.16 and 8.0.5. As a workaround, enabling AF_PACKET's defrag option in IDS mode may prevent these crafted packets from reaching Suricata.
Affected products
- OISF Suricata prior to 7.0.16 and 8.0.5
Timeline
- 2026-09-10: disclosed
- 2026-05-19: patched: Versions 7.0.16 and 8.0.5 released