Executive brief
Suricata is a network security monitoring and intrusion detection system that inspects network traffic for threats. A flaw in its SMB protocol parser allows an attacker to send sustained one-directional SMB traffic that causes unbounded accumulation of transaction state in memory and CPU, exhausting server resources and disrupting network monitoring capability.
Technical details
The SMB parser in Suricata's Rust codebase fails to properly enforce the SMB_MAX_TX transaction limit on asymmetric flows where payload is observed in only one direction, including async-oneside flows. The transaction cleanup mechanism waits for inspection in the unseen direction, allowing transactions to accumulate without bound. An attacker sending sustained one-directional SMB traffic can exhaust CPU and memory resources on the monitored system.
Affected products
- OISF Suricata prior to 7.0.17 and 8.0.6
Timeline
- 2026-09-18: disclosed: CVE-2026-63448 published
- 2026-07-01: patched: Fix committed to main branch
- 2026-07-07: patched: Fix available in versions 7.0.17 and 8.0.6