Vulnerability · Published Apr 10, 2025 · Assigned by GitHub_M
CVE-2025-29915Suricata af-packet: defrag option can lead to truncated packets affecting visibility
High 7.5
In plain English
A high-severity security flaw in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | 1:7.0.9-1 | DEBIAN-CVE-2025-29915 |
| Debian:14 | suricata | 1:7.0.9-1 | DEBIAN-CVE-2025-29915 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29915 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29915 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2025-29915 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29915 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2025-29915 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp x_refsource_CONFIRM
- https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/5373 x_refsource_MISC