Executive brief
Suricata is a network security monitoring engine that detects and prevents intrusions. Due to inadequate IP family validation in flow hash comparison, an attacker can craft packets that reuse flow state across IPv4 and IPv6 traffic, causing security rules to be bypassed and intrusions to go undetected. This allows malicious network traffic to evade detection entirely.
Technical details
The vulnerability exists in src/flow-hash.c where IPv4 and IPv6 flows are compared without verifying the IP family version, despite matching address words, ports, protocol, VLAN, and other attributes. An attacker can send IPv6 packets that reuse IPv4 flow state (or vice versa), bypassing flowbit state checks and detection rules. The flaw is fixed by explicitly comparing the IP family version before treating flows as equivalent.
Affected products
- OISF Suricata before 7.0.17 and before 8.0.6
Timeline
- 2026-09-18: disclosed