Vulnerability · Published Apr 10, 2025 · Assigned by GitHub_M
CVE-2025-29916Suricata datasets: ruleset declared settings can lead to resource starvation
Medium 6.2
In plain English
A medium-severity resource allocation without limits in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | suricata | 1:7.0.9-1 | DEBIAN-CVE-2025-29916 |
| Debian:14 | suricata | 1:7.0.9-1 | DEBIAN-CVE-2025-29916 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29916 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29916 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2025-29916 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-29916 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2025-29916 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-27g3-pmvp-j9cv x_refsource_CONFIRM
- https://github.com/OISF/suricata/commit/a7713db709b8a0be5fc5e5809ab58e9b14a16e85 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/7615 x_refsource_MISC