Executive brief
Suricata is a network security monitoring and intrusion detection system. A flaw in the SMTP MIME decoder can be triggered by specially crafted email traffic, causing Suricata to crash and creating a denial-of-service condition when the feature is enabled. An attacker can disrupt network monitoring and security visibility by sending malformed email messages.
Technical details
The vulnerability is an out-of-bounds heap buffer read in the SMTP MIME quoted-printable decoder (src/util-decode-mime.c) that occurs when a quoted-printable escape sequence is split across traffic chunks with the next chunk containing exactly one byte. This can be triggered remotely via crafted SMTP traffic when decode-quoted-printable MIME decoding is enabled, causing a crash; the issue was fixed in version 7.0.17 by adding bounds checking before buffer access.
Affected products
- OISF Suricata 7.0.13 to 7.0.16
Timeline
- 2026-09-18: disclosed
- 2026-07-07: patched: Fixed in version 7.0.17