CVE-2026-63446: Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Suricata versions from 8.0.0 through 8.0.6 are affected. Exposure requires flows that are passed by a pass rule or a pass-the-flow exception policy, because detection is skipped for those flows.
What does an attacker need to do to trigger the problem?
An attacker needs to send traffic that is handled on a passed flow. Completed application-layer transactions on that flow can remain retained and repeatedly rescanned, driving CPU and memory consumption upward.
Is immediate upgrade the available remediation?
The issue is fixed in Suricata 8.0.6. If upgrading cannot be done immediately, review use of pass rules and pass-the-flow exception policies, since those are the conditions described as allowing transaction retention.
What operational symptoms indicate possible exploitation or impact?
Affected instances may show growing per-flow transaction lists, increasing memory use, and elevated CPU consumption. Cleanup can become increasingly expensive because its cost grows quadratically as retained transactions accumulate.