Executive brief
Suricata is a network security monitoring engine that detects and prevents intrusions. A flaw in its FTP parser allows attackers to send specially crafted FTP commands that bypass the transaction limit protection, causing the system to process an excessive number of transactions with quadratic complexity. This degrades packet processing performance and can lead to denial of service, reducing the ability to detect and prevent actual attacks.
Technical details
The FTP parser in src/app-layer-ftp.c continues creating transactions beyond the configured app-layer.protocols.ftp.max-tx limit when processing a single large chunk of FTP command data. The oversized transaction list is then processed repeatedly with quadratic complexity, even after the too_many_transactions event is raised. An attacker can craft malicious FTP traffic to trigger this condition, requiring only network access to send FTP commands.
Affected products
- OISF Suricata 8.0.5 before 8.0.6
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 8.0.6