Log in Start free

Vulnerability · Published Oct 1, 2025 · Assigned by GitHub_M

CVE-2025-59147Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets

High 7.5

In plain English

A high-severity security flaw in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24suricata8.0.1-r0ALPINE-CVE-2025-59147
Debian:13suricata1:7.0.10-1+deb13u1DEBIAN-CVE-2025-59147
Debian:14suricata1:8.0.1-1DEBIAN-CVE-2025-59147
Ubuntu:22.04:LTSsuricatano fix listedUBUNTU-CVE-2025-59147
Ubuntu:24.04:LTSsuricatano fix listedUBUNTU-CVE-2025-59147
Ubuntu:25.10suricatano fix listedUBUNTU-CVE-2025-59147
Ubuntu:26.04:LTSsuricatano fix listedUBUNTU-CVE-2025-59147
Ubuntu:26.10suricatano fix listedUBUNTU-CVE-2025-59147

Affected products (as reported)

VendorProductVersions
OISF suricata < 7.0.12>= 8.0.0, < 8.0.1

Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References