CVE-2025-29915: Suricata af-packet: defrag option can lead to truncated packets affecting visibility
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AFPACKET defrag option is enabled by default and allows AFPACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29915?
CVE-2025-29915 is classified as a high-severity vulnerability due to its potential impact on network security.
How do I fix CVE-2025-29915?
To fix CVE-2025-29915, upgrade Suricata to version 7.0.10 or later where the vulnerability has been addressed.
Which versions of Suricata are affected by CVE-2025-29915?
CVE-2025-29915 affects Suricata versions up to 7.0.9.
What type of software is affected by CVE-2025-29915?
CVE-2025-29915 affects the Open Information Security Foundation's Suricata network Intrusion Detection System.
What is the main issue described in CVE-2025-29915?
CVE-2025-29915 allows AF_PACKET to re-assemble fragmented packets, which can lead to potential security risks if exploited.