Executive brief
Suricata is a network intrusion detection and prevention system that monitors and analyzes traffic. An attacker sending crafted MQTT protocol messages can cause the MQTT parser to accumulate unbounded transaction state, exhausting CPU and memory resources and leading to system slowdown or denial of service.
Technical details
The MQTT parser in rust/src/mqtt/mqtt.rs fails to enforce a limit on repeated PUBREC or PUBREL messages within a single transaction, allowing an attacker to append these messages indefinitely. This resource exhaustion occurs when processing network traffic without authentication or user interaction required. The vulnerability is resolved by bounding the number of messages per transaction.
Affected products
- OISF Suricata 7.0.0 until 7.0.17 and 8.0.0 until 8.0.6
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in versions 7.0.17 and 8.0.6