Vulnerability Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oisf | Suricata | < 7.0.13 |
Related Weaknesses (CWE)
References
- https://github.com/OISF/suricata/commit/482e5eac9218d007adbe2410d6c00173368ce947Patch
- https://github.com/OISF/suricata/security/advisories/GHSA-83v7-gm34-f437Vendor Advisory
FAQ
What is CVE-2025-64330?
CVE-2025-64330 is a vulnerability with a CVSS score of 7.5 (HIGH). Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overf...
How severe is CVE-2025-64330?
CVE-2025-64330 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-64330?
Check the references section above for vendor advisories and patch information. Affected products include: Oisf Suricata.