CVE-2024-23836 - CVE House

Back to Database

Status published High CVE-2024-23836

crafted traffic can cause denial of service

7.5 CVSS

Vulnerability Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23836

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OISF

View All →

Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer

Suricata is vulnerable to a null deref when used with base64_data

Suricata is vulnerable to unbounded memory growth for decompression

Suricata is vulnerable to a stack overflow from big content-type

Suricata is vulnerable to a stack overflow on larger compressed data

Affected Vendor

OISF

View all reports →

Affected Software

suricata

Vulnerable Versions:

< 6.0.16, >= 7.0.0, < 7.0.3

Timeline

Official Publish: February 26th, 2024

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery