CVE-2026-63447: Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the toomanytransactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Suricata versions from 8.0.5 until 8.0.6 are affected when processing FTP traffic. The impact is on packet-processing capacity, potentially reducing monitoring visibility or causing denial of service.
What must an attacker do to exploit the issue?
An attacker must send crafted FTP traffic containing a large chunk of FTP command data. No authentication or user interaction is required.
Does setting app-layer.protocols.ftp.max-tx prevent exploitation?
No. The flaw occurs because the FTP parser can continue allocating transactions after app-layer.protocols.ftp.max-tx has been reached while processing a single large command-data chunk.
How can this be remediated?
Upgrade Suricata to version 8.0.6, which fixes the issue.