CVE-2026-63447

Suricata (OISF network IDS/IPS/NSM engine) versions 8.0.5 through 8.0.6 are affected by a quadratic CPU consumption vulnerability in the FTP parser (src/app-layer-ftp.c). When processing a single large chunk of FTP command data, the parser can continue allocating transactions even after the app-l...

CVE-2026-63448

Suricata (OISF), a network IDS/IPS/NSM engine, is vulnerable to resource exhaustion in its SMB parser prior to versions 7.0.17 and 8.0.6 . On flows where Suricata observes payload in only one direction (including async-oneside flows), the parser retains force-completed transactions because cleanu...

CVE-2026-57229

Suricata's SMTP MIME parser (rust/src/mime/smtp.rs) in versions 8.0.0 through 8.0.6 fails to fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's filename or Content-Transfer-Encoding state leaks into the inner message, allowing a crafted email to byp...

CVE-2026-63452

Suricata (OISF), a network IDS/IPS/NSM engine, is affected in versions 8.0.0 through 8.0.6 . The HTTP/1 parser enforces a per-transaction decompression limit but does not cap the total number of small brotli compression bombs a single flow can submit. When the response-body-decompress-layer-limit...

CVE-2026-63451

Suricata (OISF) versions 8.0.0 through 8.0.6 are affected by a heap buffer overflow in src/detect-engine-prefilter.c. A locally supplied detection rule that combines frame inspection without content and a transformed match without content can cause the prefilter to select multiple non-prefilter f...

CVE-2026-57227

Suricata (a network IDS/IPS/NNSM engine) has a denial-of-service vulnerability in its MQTT parser (rust/src/mqtt/mqtt.rs). The root cause is that repeated PUBREC or PUBREL messages can be appended to a single transaction without any limit, allowing crafted MQTT traffic to grow transaction state i...

CVE-2026-63449

Suricata versions 8.0.0 through 8.0.6 are affected by a SIP parser flaw in rust/src/sip/parser.rs, where request and response body lengths are stored in 16-bit fields . A SIP body exceeding 65,536 bytes truncates the stored length, causing frame:request.body or frame:response.body to omit part of...

CVE-2026-57228

CVE-2026-57228 is a heap out-of-bounds read in the SMTP MIME quoted-printable decoder (src/util-decode-mime.c) of Suricata versions 7.0.13 through 7.0.17 . When a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte, Suricata reads one ...

CVE-2026-57224

Suricata versions 8.0.0 through 8.0.6 are affected by a denial-of-service vulnerability in the DHCP parser (rust/src/dhcp/dhcp.rs) and RDP parser (rust/src/rdp/rdp.rs). Both parsers create stateless transactions without recording packet direction via AppLayerTxData::for_direction(). When a sensor...

CVE-2026-57226

Suricata , a network IDS/IPS/NMS engine, is vulnerable to a heap buffer overflow in its HTTP SWF decompression path (src/util-file-decompression.c). When the non-default swf-decompression feature is enabled with an unsafe decompress-depth value, the configured depth is used for memory allocation ...

CVE-2026-57222

Suricata , a network IDS/IPS/NSM engine, is affected by a hash collision in src/ippair.c where IPv4 and IPv6 address pairs can collide because the IP address family is not compared before reusing IPPair-backed state. This causes incorrect detection state to be applied across IP families for xbits...

scirius

Scirius Introducción Scirius Community Edition es una interfaz web dedicada a la gestión de conjuntos de reglas de Suricata. Maneja el archivo de reglas y los archivos de actualización asociados. .. image:: https://github.com/StamusNetworks/scirius/raw/master/doc/images/suricata-index.png :alt:...

Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs Source IPs attempting attacks using Apache Log4j RCE, including a large number of Tor nodes, see Attack-IP.md IOCs for malware, botnets, etc. propagated via the Log4j vulnerability, see IOC-C2.md Snort detection rules, see Snort.md Suricata rules, see...

phantom-playbooks

This is the Corelight Repository for Community Playbooks developed for Splunk Phantom. These provide some examples for you to craft your own playbooks. Corelight Investigate DNS Alert This playbook takes a saved search or alert mechanism for DNS from Splunk and pulls the Zeek UID for the alerts. ...

threat-intel

threat-intel 이 저장소에는 Volexity 공개 위협 인텔리전스 블로그 게시물과 관련된 IoC가 포함되어 있습니다. 이러한 IoC와 관련된 공개 블로그 게시물은 Volexity 웹사이트에서 확인할 수 있습니다. 과거에는 이 저장소에 Volexity가 발표한 도구도 저장되었습니다. 이러한 도구는 이제 각 도구 전용 저장소로 이동되었으며, Volexity GitHub 페이지에서 찾을 수 있습니다. IOCs 연도별로 정리되어 있으며, 각 연도 내에서 각 폴더는 특정 게시물과 연결됩니다. 각 게시물은 대략 동일한 폴더 구조...

Zeek-CVE-Enrichment

zeek-cve-enrichment This package enriches the suricatacorelight and notice Corelight logs with known CVE information. To collect the CVE information, it first uses a Python script reformat.py to read a CSV file containing IP addresses, hostnames, and CVE Common Vulnerabilities and Exposures...

C2-detection-manjusaka

Detecting the "Manjusaka" C2 framework Detecting the C2 framework Manjusaka: "A Chinese sibling of Sliver and Cobalt Strike" References: Detection logic details: https://corelight.com/blog/detecting-manjusaka-c2-framework Writeup by Talos:...

NexaCorp-DFIR-INC-2026-001

NexaCorp DFIR: INC-2026-001 - Linux Infrastructure Compromise DFIR investigation and detection engineering on a simulated intrusion against NexaCorp infrastructure. Conducted as a 4-day solo engagement BeCode Brussels Blue & Red Team bootcamp, Mission 01. The deliverable is a 54-page findings...

ids_bypass

Disclaimer These programs is for Educational purpose ONLY. Do not use it without permission. injectserver: Proof-Of-Concept for CVE-2018-6794. If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be...

pulledpork

PulledPork Snort 및 Suricata 규칙 관리를 위한 PulledPork Google 코드에서 Libera.ChatIRC에서 우리를 찾아보세요 pulledpork 저작권 C 2009-2021 JJ Cummings, Michael Shirk 및 PulledPork 팀! PulledPork를 선택해 주셔서 감사합니다! 이 파일은 PulledPork 사용에 대한 기본적인 지침을 제공합니다. 놓치는 부분이 없도록 이 파일을 철저히 읽어 주시기 바랍니다. 기능 및 특징 모든 snort 규칙 세트의 자동 다운로드, 파싱, ...