Executive brief
Suricata is a network security monitoring and intrusion detection system used to inspect traffic and protect networks. A vulnerability in LDAP protocol handling allows an attacker to send crafted traffic that forces Suricata to store unlimited responses in memory, exhausting resources and causing the service to stop functioning. This results in a denial of service where network monitoring is disabled.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400, CWE-770) in Suricata's LDAP application-layer protocol parser. The LDAP transaction state mechanism fails to impose limits on the number of responses buffered per transaction. Because LDAP can be transported over UDP, an attacker on the network can send crafted LDAP traffic to trigger unbounded memory allocation. No authentication or user interaction is required; the attack is network-accessible. Exploitation results in memory exhaustion and denial of service of the Suricata monitoring engine. The fix is available in version 8.0.5; affected versions are 8.0.0 through 8.0.4. Workarounds include disabling LDAP parsing or implementing response count limits via detection rules.
Affected products
- OISF Suricata 8.0.0 to 8.0.4
Timeline
- 2026-09-10: disclosed
- 2026-05-19: patched: Fixed in Suricata 8.0.5