CVE-2025-64344: Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64344?
CVE-2025-64344 is classified as a high severity vulnerability due to its potential to cause a stack overflow.
How do I fix CVE-2025-64344?
To mitigate CVE-2025-64344, users should update Suricata to versions 7.0.13 or 8.0.2 or later.
What software is affected by CVE-2025-64344?
CVE-2025-64344 affects OISF Suricata versions prior to 7.0.13 and 8.0.2.
Can CVE-2025-64344 be exploited remotely?
Yes, CVE-2025-64344 can be exploited remotely if an attacker can send malicious Lua scripts to Suricata.
What are the potential impacts of CVE-2025-64344?
Exploitation of CVE-2025-64344 could lead to a denial of service condition due to stack overflow.