CVE-2026-63449: Suricata sip: large SIP message bodies can evade detection with frame keyword
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricata SIP parser (rust/src/sip/parser.rs)to a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions from 8.0.0 through 8.0.5 are affected. The issue concerns SIP traffic inspected with the frame:request.body or frame:response.body keywords.
What does an attacker need to do to evade detection?
An attacker needs to send a SIP request or response with a body larger than 65,536 bytes and place the relevant content in the portion omitted from frame-based inspection. No privileges or user interaction are required, but the attack complexity is rated high.
Are all SIP detections bypassed?
The documented impact is limited to detection using frame:request.body or frame:response.body, where the complete oversized body may not be exposed for inspection. The data does not establish an impact on other SIP inspection methods.
How can this be remediated?
Upgrade to Suricata 8.0.6, which fixes the SIP body-length handling issue. If upgrading is not immediately possible, review reliance on frame-based body inspection for SIP messages larger than 65,536 bytes, since content beyond the truncated length may evade those rules.