CVE-2025-64332
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oisf | suricata | to 7.0.13 (exc) |
| oisf | suricata | From 8.0.0 (inc) to 8.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack overflow in Suricata that occurs when SWF decompression is enabled. It can cause Suricata to crash. The issue affects versions prior to 7.0.13 and 8.0.2 and has been patched in those versions. A workaround is to disable SWF decompression or limit the decompress-depth setting.
How can this vulnerability impact me? :
The vulnerability can cause Suricata to crash, leading to denial of service in network intrusion detection and prevention operations. This can reduce the effectiveness of network security monitoring and potentially leave the network unprotected during the crash.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Suricata installation has SWF decompression enabled and is running a vulnerable version prior to 7.0.13 or 8.0.2. You can verify the Suricata version by running the command: `suricata --build-info`. To check if SWF decompression is enabled, inspect the suricata.yaml configuration file for the 'swf-decompression' setting. Additionally, monitoring Suricata logs for crashes or stack overflow errors related to SWF decompression may indicate the presence of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade Suricata to version 7.0.13 or 8.0.2 or later where the issue is patched. If upgrading is not possible immediately, disable SWF decompression by setting 'swf-decompression' to false in the suricata.yaml configuration file. If SWF decompression must remain enabled, set 'decompress-depth' to a value lower than half your stack size to reduce the risk of stack overflow.