CVE-2026-63448 Suricata smb: some SMB flows can cause resource exhaustion

🗓️ 18 Sep 2026 20:20:01Reported by GitHub_MType

Suricata SMB parser resource exhaustion via one-directional flows prior to 7.0.17 and 8.0.6.

Reporter	Title	Published	Views	Family All 14
CVE	CVE-2026-63448	18 Sep 202620:20	–	cve
Debian CVE	CVE-2026-63448	18 Sep 202620:20	–	debiancve
EUVD	EUVD-2026-83393	18 Sep 202620:20	–	euvd
Mend	CVE-2026-63448	18 Sep 202620:20	–	mend
NVD	CVE-2026-63448	18 Sep 202621:17	–	nvd
OSV	DEBIAN-CVE-2026-63448	18 Sep 202621:17	–	osv
OSV	UBUNTU-CVE-2026-63448	18 Sep 202621:17	–	osv
Positive Technologies	PT-2026-95654	21 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-63448: Uncontrolled Resource Consumption	18 Sep 202600:00	–	rapid7
RedhatCVE	CVE-2026-63448	23 Sep 202609:03	–	redhatcve

[
  {
    "vendor": "OISF",
    "product": "suricata",
    "versions": [
      {
        "version": ">= 8.0.0, < 8.0.6",
        "status": "affected"
      },
      {
        "version": "< 7.0.17",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281
github	www.github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce
github	www.github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476
github	www.github.com/OISF/suricata/releases/tag/suricata-7.0.17
github	www.github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3
github	www.github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4
github	www.github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a
github	www.github.com/OISF/suricata/releases/tag/suricata-8.0.6
github	www.github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35
redmine	www.redmine.openinfosecfoundation.org/issues/8629

18 Sep 2026 20:20Current

CVSS 3.15.9

EPSS0.00447

SSVC

Suricata SMB parser resource exhaustion one-directional flows CPU memory exhaustion