CVE-2026-63450

Suricata (OISF) FTP application-layer parser in src/app-layer-ftp.c, prior to 8.0.6 , escalates a protocol-recoverable command-ordering error—RETR/STOR sent before PORT/PASV negotiation —to an unrecoverable APP_LAYER_ERROR (CWE-754 ). This disables all subsequent FTP application-layer inspection ...

CVE-2026-63449 Suricata sip: large SIP message bodies can evade detection with frame keyword

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...

CVE-2026-63449

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...

CVE-2026-63449

Suricata versions 8.0.0 through 8.0.6 are affected by a SIP parser flaw in rust/src/sip/parser.rs, where request and response body lengths are stored in 16-bit fields . A SIP body exceeding 65,536 bytes truncates the stored length, causing frame:request.body or frame:response.body to omit part of...

CVE-2026-63449 Suricata sip: large SIP message bodies can evade detection with frame keyword

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the...

CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57228

CVE-2026-57228 is a heap out-of-bounds read in the SMTP MIME quoted-printable decoder (src/util-decode-mime.c) of Suricata versions 7.0.13 through 7.0.17 . When a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte, Suricata reads one ...

CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57224

Suricata versions 8.0.0 through 8.0.6 are affected by a denial-of-service vulnerability in the DHCP parser (rust/src/dhcp/dhcp.rs) and RDP parser (rust/src/rdp/rdp.rs). Both parsers create stateless transactions without recording packet direction via AppLayerTxData::for_direction(). When a sensor...

CVE-2026-57224 Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::fordirection, so a...

CVE-2026-57226 Suricata swf: heap buffer overflow in SWF decompression depth handling

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in...

CVE-2026-57226

Suricata , a network IDS/IPS/NMS engine, is vulnerable to a heap buffer overflow in its HTTP SWF decompression path (src/util-file-decompression.c). When the non-default swf-decompression feature is enabled with an unsafe decompress-depth value, the configured depth is used for memory allocation ...

CVE-2026-57222 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

CVE-2026-57222

Suricata , a network IDS/IPS/NSM engine, is affected by a hash collision in src/ippair.c where IPv4 and IPv6 address pairs can collide because the IP address family is not compared before reusing IPPair-backed state. This causes incorrect detection state to be applied across IP families for xbits...

CVE-2026-57222 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

NexaCorp-DFIR-INC-2026-001

NexaCorp DFIR: INC-2026-001 - Linux Infrastructure Compromise DFIR investigation and detection engineering on a simulated intrusion against NexaCorp infrastructure. Conducted as a 4-day solo engagement BeCode Brussels Blue & Red Team bootcamp, Mission 01. The deliverable is a 54-page findings...

CVE-2025-32433

Erlang/OTP SSH CVE-2025-32433 安全研究 Python 漏洞利用概念验证 CVE-2025-32433 在 Erlang/OTP SSH 中的未认证远程代码执行。我还提供了一个 横幅抓取 Nuclei 模板 和一个 Nuclei RCE 检测。 Suricata 和 Zeek IDS 日志按顺序记录了：一次成功的 Paramiko 攻击，两次未受攻击的正常 OpenSSH9.8 连接，两次使用 ProDefense/CVE-2025-32433 的成功攻击，以及一次使用 iamnoooob、rootxharsh、pdresearch 的...

suricata-script

This repository does not have a README...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Señuelo de prueba de concepto defensivo para CVE-2025-59287 WSUS. El señuelo emula los endpoints web de WSUS en los puertos 8530 y 8531, captura cuerpos de solicitudes HTTP completos y cabeceras, almacena evidencia para análisis forense, e incluye un arnés de pruebas de Windows para...

CVE-2026-45767

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A highly privileged remote attacker could exploit this vulnerability by crafting a malicious rule. When this rule is loaded or reloaded, it could allow...