CVE-2025-64330: Suricata is vulnerable to a heap buffer overflow on verdict
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64330?
CVE-2025-64330 is classified as a high severity vulnerability due to the potential for crashes caused by a heap overflow.
How do I fix CVE-2025-64330?
To fix CVE-2025-64330, upgrade Suricata to version 7.0.13 or later, or version 8.0.2 or later.
What components are affected by CVE-2025-64330?
CVE-2025-64330 affects Suricata versions prior to 7.0.13 and 8.0.2, particularly when logging in eve.alert and eve.drop records.
What could happen if I am still using an affected version of Suricata with CVE-2025-64330?
Using an affected version of Suricata may lead to crashes, affecting network security monitoring capabilities.
Who is responsible for fixing CVE-2025-64330?
The responsibility for fixing CVE-2025-64330 lies with users and administrators of the affected Suricata software.