Vulnerability · Published Nov 26, 2025 · Assigned by GitHub_M
CVE-2025-64335Suricata is vulnerable to a null deref when used with base64_data
High 7.5
In plain English
A high-severity null pointer dereference in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | suricata | 8.0.2-r0 | ALPINE-CVE-2025-64335 |
| Debian:14 | suricata | 1:8.0.2-1 | DEBIAN-CVE-2025-64335 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-64335 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2025-64335 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2025-64335 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-v299-h7p3-q4f2 x_refsource_CONFIRM
- https://github.com/OISF/suricata/commit/c935f08cd988600fd0a4f828a585b181dd5de012 x_refsource_MISC
- https://www.vicarius.io/vsociety/posts/cve-2025-64335-detect-suricata-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-64335-mitigate-suricata-vulnerability