CVE-2025-29916 - CVE House
Back to Database
Status published Medium CVE-2025-29916

Suricata datasets: ruleset declared settings can lead to resource starvation

Vulnerability Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29916

Credits & Attribution

No credits recorded in the NVD database.

References

More from OISF

View All →
CVE-2025-64344
Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer
High 7.5
CVE-2025-64335
Suricata is vulnerable to a null deref when used with base64_data
High 7.5
CVE-2025-64334
Suricata is vulnerable to unbounded memory growth for decompression
High 7.5
CVE-2025-64333
Suricata is vulnerable to a stack overflow from big content-type
High 7.5
CVE-2025-64332
Suricata is vulnerable to a stack overflow on larger compressed data
High 7.5

Affected Vendor

Affected Software

suricata
Vulnerable Versions:
< 7.0.9

Timeline

Official Publish: April 10th, 2025
Last Modified: April 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery