U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2024-23836 Detail

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://github.com/OISF/suricata/commit/18841a58da71e735ddf4e52cbfa6989755ecbeb7 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/2a2120ecf10c5b5713ec2bf59469fe57f7b5b747 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/83c5567ea7b0b28376f57dcfee9c6301448c7bc7 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/8efaebe293e2a74c8e323fa85a6f5fadf82801bc CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/97953998d2d60673ed6c30ddfb6a2d59b4230f97 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/b1549e930f6426eeff43f12b672337cbcda566b8 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/cd035d59e3df157b606f4fe67324ea8e437be786 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/ce9b90326949c94a46611d6394e28600ee5e8bd5 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/e7e28822f473320658d6125f16ac3f0524baff01 CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/commit/f9de1cca6182e571f1c02387dca6e695e55608af CVE, GitHub, Inc. Patch 
https://github.com/OISF/suricata/security/advisories/GHSA-q33q-45cr-3cpc CVE, GitHub, Inc. Vendor Advisory 
https://lists.fedoraproject.org/archives/list/[email protected]/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/ CVE, GitHub, Inc. Mailing List 
https://lists.fedoraproject.org/archives/list/[email protected]/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/ CVE, GitHub, Inc. Mailing List 
https://redmine.openinfosecfoundation.org/issues/6531 CVE, GitHub, Inc. Issue Tracking 
https://redmine.openinfosecfoundation.org/issues/6532 CVE, GitHub, Inc. Issue Tracking 
https://redmine.openinfosecfoundation.org/issues/6540 CVE, GitHub, Inc. Issue Tracking 
https://redmine.openinfosecfoundation.org/issues/6658 CVE, GitHub, Inc. Issue Tracking 
https://redmine.openinfosecfoundation.org/issues/6659 CVE, GitHub, Inc. Issue Tracking 
https://redmine.openinfosecfoundation.org/issues/6660 CVE, GitHub, Inc. Issue Tracking 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-770 Allocation of Resources Without Limits or Throttling cwe source acceptance level NIST   GitHub, Inc.  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2024-23836
NVD Published Date:
02/26/2024
NVD Last Modified:
12/19/2024
Source:
GitHub, Inc.