CVE-2026-63447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63447", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T19:35:57.767Z", "datePublished": "2026-09-18T20:21:06.510Z", "dateUpdated": "2026-09-21T18:21:33.801Z"}, "containers": {"cna": {"title": "Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9"}, {"name": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385", "tags": ["x_refsource_MISC"], "url": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385"}, {"name": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5", "tags": ["x_refsource_MISC"], "url": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5"}, {"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"}, {"name": "https://redmine.openinfosecfoundation.org/issues/8592", "tags": ["x_refsource_MISC"], "url": "https://redmine.openinfosecfoundation.org/issues/8592"}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"version": ">= 8.0.5, < 8.0.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T20:21:06.510Z"}, "descriptions": [{"lang": "en", "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6."}], "source": {"advisory": "GHSA-w394-3g33-3jg9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T18:21:07.869708Z", "id": "CVE-2026-63447", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T18:21:33.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T18:21:07.869708Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T18:21:15.444Z"}}], "cna": {"title": "Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption", "source": {"advisory": "GHSA-w394-3g33-3jg9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": ">= 8.0.5, < 8.0.6"}]}], "references": [{"url": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9", "name": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385", "name": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5", "name": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6", "name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6", "tags": ["x_refsource_MISC"]}, {"url": "https://redmine.openinfosecfoundation.org/issues/8592", "name": "https://redmine.openinfosecfoundation.org/issues/8592", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T20:21:06.510Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63447", "state": "PUBLISHED", "dateUpdated": "2026-09-21T18:21:33.801Z", "dateReserved": "2026-07-16T19:35:57.767Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-18T20:21:06.510Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "suricata", "vendor": "OISF", "versions": [{"status": "affected", "version": ">= 8.0.5, < 8.0.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:8.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "F6DB18F1-6359-40D3-B5BA-A66CFF6BEE87", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6."}], "id": "CVE-2026-63447", "lastModified": "2026-09-28T18:34:20.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63447", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T18:21:07.869708Z", "version": "2.0.3"}}]}, "published": "2026-09-18T21:17:03.913", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://redmine.openinfosecfoundation.org/issues/8592"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "suricata: suricata: Denial of Service via crafted FTP traffic", "id": "2538858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538858"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.", "A flaw was found in Suricata. A remote, unauthenticated attacker can exploit this issue by sending specially crafted File Transfer Protocol (FTP) traffic containing large command sequences, causing the parser to allocate transactions beyond expected limits. Processing this oversized transaction list leads to excessive CPU resource consumption, resulting in degraded packet inspection capabilities and a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-63447", "public_date": "2026-09-18T20:21:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63447\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63447\nhttps://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385\nhttps://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5\nhttps://github.com/OISF/suricata/releases/tag/suricata-8.0.6\nhttps://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9\nhttps://redmine.openinfosecfoundation.org/issues/8592"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker transmitting network traffic inspected by Suricata can trigger severe CPU exhaustion without requiring privileges, leading to packet processing starvation and denial of service. In typical deployments where Suricata passively monitors high-throughput network segments, malicious FTP payloads can degrade inspection performance across all monitored flows. Environments that do not inspect FTP traffic or that strictly filter network access to monitored boundaries experience substantially lower operational risk.\nRed Hat does not ship versions affected by this vulnerability.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.5,8.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "suricata", "source": "cna", "vendor": "OISF"}, "product": "suricata", "vendor": "oisf"}], "created": "2026-09-19T11:30:06.473955+00:00", "updated": "2026-10-01T21:45:06.856795+00:00", "vendors": ["oisf", "oisf$PRODUCT$suricata"]}