# CVE-2026-63447: Suricata FTP parser denial of service via transaction limit bypass

Source: https://junglewise.ai/threats/cve-2026-63447-suricata-is-a-network-intrusion-detection-system-intrusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-63447 · Severity: high · CVSS 7.5 · Published 2026-09-18

Suricata is a network security monitoring engine that detects and prevents intrusions. A flaw in its FTP parser allows attackers to send specially crafted FTP commands that bypass the transaction limit protection, causing the system to process an excessive number of transactions with quadratic complexity. This degrades packet processing performance and can lead to denial of service, reducing the ability to detect and prevent actual attacks.

Technologies: [OISF Suricata](https://junglewise.ai/threats/technologies/suricata). Vendors: [OISF](https://junglewise.ai/threats/vendors/oisf).

## Quick answers

**Is CVE-2026-63447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63447 being exploited in the wild.

**How severe is CVE-2026-63447?** High severity, with a CVSS score of 7.5, published 18 September 2026.

**Which products and versions are affected?** OISF Suricata 8.0.5 before 8.0.6.

**Is there a fix for CVE-2026-63447?** A patch was published on 2026-09-18: Fixed in version 8.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63447 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63447?** Check whether you run OISF Suricata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FTP parser in src/app-layer-ftp.c continues creating transactions beyond the configured app-layer.protocols.ftp.max-tx limit when processing a single large chunk of FTP command data. The oversized transaction list is then processed repeatedly with quadratic complexity, even after the too_many_transactions event is raised. An attacker can craft malicious FTP traffic to trigger this condition, requiring only network access to send FTP commands.

## Affected products

- OISF Suricata 8.0.5 before 8.0.6

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 8.0.6

## References

- [https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385](https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385)
- [https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5](https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5)

## Related threats

- [Suricata use-after-free in HTTP/2 response header detection](https://junglewise.ai/threats/cve-2026-94084-suricata-before-8-0-7-has-an-http2threadmultibuf-use-after-free)
- [Suricata DoH2 type confusion in HTTP state cleanup](https://junglewise.ai/threats/cve-2026-94083-suricata-before-8-0-7-has-a-doh2-type-confusion-that-can-cause-an)
- [Suricata IP family validation bypass in flow comparison](https://junglewise.ai/threats/cve-2026-71855-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata DNS-over-HTTP/2 buffer memory handling denial of service](https://junglewise.ai/threats/cve-2026-71418-suricata-is-a-network-intrusion-detection-system-intrusion)
- [Suricata HTTP/1 compression bomb denial of service](https://junglewise.ai/threats/cve-2026-63452-suricata-is-a-network-intrusion-detection-system-intrusion)