CVE-2026-63450: Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions prior to 8.0.6 are affected when they inspect FTP traffic. In IDS or NSM use, the condition disables FTP application-layer parsing for the rest of the TCP flow; in IPS mode, Suricata drops the flow instead.
What must an attacker do to trigger the parsing failure?
An attacker must send an FTP RETR or STOR command before PORT or PASV negotiation within a TCP flow. This is network-reachable and requires no privileges or user interaction, but has high attack complexity.
What is the impact after triggering the issue in IDS mode?
Later FTP commands on the same TCP flow can evade rules and logging that depend on FTP application-layer parsing. The stated impact is integrity-related; no confidentiality or availability impact is specified.
What should be done to remediate the issue?
Upgrade Suricata to version 8.0.6, which fixes the FTP parser behavior.