CVE-2025-64331: Suricata is vulnerable to a stack overflow on large file transfers with http-body-printable
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow can occur on large HTTP file transfers if the user has increased the HTTP response body limit and enabled the logging of printable http bodies. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves using default HTTP response body limits and/or disabling http-body-printable logging; body logging is disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/suricatato a version that resolves this vulnerability.Fixed in 8.0.2-r0 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.2 - Configuration
Disable http-body-printable logging; body logging is disabled by default.
Suricata http-body-printable logging = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64331?
CVE-2025-64331 has a high severity rating due to the potential for a stack overflow during large HTTP file transfers.
How do I fix CVE-2025-64331?
To fix CVE-2025-64331, upgrade Suricata to version 7.0.13 or 8.0.2 or later.
What versions of Suricata are affected by CVE-2025-64331?
Versions of Suricata prior to 7.0.13 and 8.0.2 are affected by CVE-2025-64331.
What are the consequences of exploiting CVE-2025-64331?
Exploiting CVE-2025-64331 can lead to a denial of service due to the stack overflow.
Is CVE-2025-64331 related to HTTP file transfers?
Yes, CVE-2025-64331 specifically concerns a stack overflow that occurs during large HTTP file transfers.