CVE-2025-59147: Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59147?
CVE-2025-59147 has been classified with a high severity due to its potential for detection bypass.
How do I fix CVE-2025-59147?
To fix CVE-2025-59147, upgrade Suricata to version 8.0.1 or later.
What versions of Suricata are affected by CVE-2025-59147?
Suricata versions 7.0.11 and below, as well as version 8.0.0, are affected by CVE-2025-59147.
What type of attack does CVE-2025-59147 facilitate?
CVE-2025-59147 facilitates detection bypass via crafted traffic that sends multiple SYN packets with varied sequence numbers.
Who is responsible for fixing CVE-2025-59147?
The Open Information Security Foundation (OISF) and the Suricata community are responsible for addressing CVE-2025-59147.