CVE-2025-64344: Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/suricatato a version that resolves this vulnerability.Fixed in 8.0.2-r0 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.13 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.2 - Configuration
Disable Lua rules and output scripts as a workaround.
Suricata Lua rules and output scripts = disabled - Configuration
Set stream.depth.reassembly and the HTTP response body limit (response-body-limit) to less than half the stack size.
Suricata stream.depth.reassembly and response-body-limit = less than half the stack size
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64344?
CVE-2025-64344 is classified as a high severity vulnerability due to its potential to cause a stack overflow.
How do I fix CVE-2025-64344?
To mitigate CVE-2025-64344, users should update Suricata to versions 7.0.13 or 8.0.2 or later.
What software is affected by CVE-2025-64344?
CVE-2025-64344 affects OISF Suricata versions prior to 7.0.13 and 8.0.2.
Can CVE-2025-64344 be exploited remotely?
Yes, CVE-2025-64344 can be exploited remotely if an attacker can send malicious Lua scripts to Suricata.
What are the potential impacts of CVE-2025-64344?
Exploitation of CVE-2025-64344 could lead to a denial of service condition due to stack overflow.