CVE-2026-63447
highpriority · track · 0EPSS 0.006 · 50 %ileUSEPSS · scored 2026-10-27
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
sources
Which sources assert this record, and when.
references (5) nvd
External citations — patches, advisories, analysis.
- https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385Patch
- https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5Patch
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6Release Notes
- https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9MitigationVendor Advisory
- https://redmine.openinfosecfoundation.org/issues/8592Permissions Required
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan