CVE-2025-59148
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-10-06

Assigner: GitHub, Inc.

Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-01
Last Modified
2025-10-06
Generated
2026-06-16
AI Q&A
2025-10-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-59148
EUVD
EUVD-2025-33225
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
oisf suricata 8.0.0
oisf suricata 8.0.0
oisf suricata 8.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Suricata versions 8.0.0 and below involves incorrect handling of the entropy keyword when it is not anchored to a "sticky" buffer. This improper handling can cause a segmentation fault, which is a type of crash or memory error. The issue is fixed in version 8.0.1, and users can mitigate it by disabling rules that use the entropy keyword or ensuring those rules are anchored to a sticky buffer.

Impact Analysis

The vulnerability can cause Suricata to crash due to a segmentation fault when processing certain rules involving the entropy keyword. This can lead to denial of service (DoS) conditions where the network intrusion detection or prevention system becomes unavailable, potentially reducing network security monitoring and protection.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Suricata to version 8.0.1 or later. As a workaround, you can disable rules that use the entropy keyword or ensure that these rules are anchored to a sticky buffer.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart