CVE-2026-63448: Suricata smb: some SMB flows can cause resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMBMAXTX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.17
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Suricata deployments running versions earlier than 7.0.17 or 8.0.6 are affected when they process SMB flows for which payload is visible in only one direction, including async-oneside flows.
What does an attacker need to do to trigger the resource exhaustion?
An attacker needs to sustain one-directional SMB traffic through the Suricata sensor. No privileges or user interaction are required, but the attack complexity is rated high.
What is the operational impact of exploitation?
Affected SMB flows can accumulate unbounded per-flow transaction state while cleanup repeatedly scans the growing transaction list. This can exhaust CPU and memory resources and degrade or disrupt Suricata processing.
How can the issue be remediated?
Upgrade Suricata to version 7.0.17 or 8.0.6, which contain the fix.