CVE-2025-59150: Suricata: Keyword tls.subjectaltname can lead to NULL-ptr deref
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59150?
CVE-2025-59150 has been classified as a medium severity vulnerability due to its potential to cause a segmentation fault.
How do I fix CVE-2025-59150?
To fix CVE-2025-59150, you should upgrade to Suricata version 8.0.1 or later, which contains the necessary patches.
Which version of Suricata is affected by CVE-2025-59150?
Suricata version 8.0.0 is the only version known to be affected by CVE-2025-59150.
What conditions lead to the exploitation of CVE-2025-59150?
CVE-2025-59150 can be exploited if the decoded subjectaltname from TLS contains a NULL byte.
Is CVE-2025-59150 related to network security issues?
Yes, CVE-2025-59150 is related to a vulnerability in Suricata, which is a network IDS and IPS, affecting its ability to handle TLS subjectaltname decoding.