CVE-2025-29915 - CVE House

Back to Database

Status published High CVE-2025-29915

Suricata af-packet: defrag option can lead to truncated packets affecting visibility

7.5 CVSS

Vulnerability Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29915

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OISF

View All →

Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer

Suricata is vulnerable to a null deref when used with base64_data

Suricata is vulnerable to unbounded memory growth for decompression

Suricata is vulnerable to a stack overflow from big content-type

Suricata is vulnerable to a stack overflow on larger compressed data

Affected Vendor

OISF

View all reports →

Affected Software

suricata

Vulnerable Versions:

< 7.0.9

Timeline

Official Publish: April 10th, 2025

Last Modified: April 10th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation