CVE-2025-59148: Oisf Suricata DoS Vulnerability

CVE-2025-59148 Overview

CVE-2025-59148 affects Suricata, the open-source network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring (NSM) engine maintained by the Open Information Security Foundation (OISF). Suricata versions 8.0.0 and below incorrectly handle the entropy keyword when it is not anchored to a sticky buffer. The flaw can trigger a segmentation fault, terminating the Suricata process and disrupting network monitoring. The issue is classified as a NULL Pointer Dereference [CWE-476] and is fixed in version 8.0.1.

Critical Impact

Remote attackers can crash Suricata sensors by inducing traffic patterns that exercise rules using an improperly anchored entropy keyword, causing loss of IDS/IPS visibility.

Affected Products

• Oisf Suricata 8.0.0
• Oisf Suricata 8.0.0-beta1
• Oisf Suricata 8.0.0-rc1

Discovery Timeline

• 2025-10-01 - CVE-2025-59148 published to NVD
• 2025-10-06 - Last updated in NVD database

Technical Details for CVE-2025-59148

Vulnerability Analysis

The vulnerability resides in Suricata's rule language parser and detection engine, specifically in how the entropy keyword interacts with buffer anchoring. Sticky buffers in Suricata bind subsequent content matches to a defined inspection context, such as http.uri or http.header. When the entropy keyword is declared without anchoring to a sticky buffer, the detection engine dereferences a pointer that has not been initialized for an inspection context.

This condition produces a NULL pointer dereference and results in a segmentation fault. Since Suricata runs as a single multi-threaded process, a crash terminates packet inspection across all threads. Defenders lose network visibility and any inline IPS deployment fails open or closed depending on configuration, both of which are undesirable outcomes during an active incident.

Root Cause

The root cause is improper validation of detection context before pointer access in the entropy keyword handler. The parser accepts rules that declare entropy outside the scope of a sticky buffer, but the runtime detection path assumes a valid buffer pointer is present. The upstream fix in commit 9f32550e18f97ea5d610dd7c36aab0ba142c096c corrects the handling so that misconfigured or unanchored usage no longer reaches the faulting code path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can deliver traffic inspected by a Suricata sensor running a vulnerable rule set can trigger the segmentation fault. The condition depends on the deployed rules rather than the attacker's payload alone, so exploitation is feasible whenever an operator has loaded a rule containing an unanchored entropy keyword. The result is a denial of service against the inspection engine.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-5qf6-92xg-3rr3 and the OISF Redmine issue 7838 for upstream technical details.

Detection Methods for CVE-2025-59148

Indicators of Compromise

• Unexpected Suricata process termination accompanied by SIGSEGV entries in dmesg or systemd journal logs.
• Gaps in eve.json event output or sudden cessation of stats.log updates from a Suricata sensor.
• Core dump files generated by the Suricata binary in the configured crash directory.

Detection Strategies

• Audit loaded rule sets for occurrences of the entropy keyword and verify each instance is anchored to a sticky buffer such as http.uri, http.header, or file.data.
• Monitor Suricata supervisor or systemd unit restart counters for abnormal frequency, which indicates repeated crashes.
• Correlate sensor downtime with upstream network telemetry to detect adversaries probing for IDS coverage gaps.

Monitoring Recommendations

• Forward Suricata stats.log and process health metrics to a centralized logging or SIEM platform for continuous availability monitoring.
• Configure alerting on Suricata exit codes and on absence of expected heartbeat events within defined intervals.
• Track rule update pipelines so newly distributed rules using entropy are validated before deployment to production sensors.

How to Mitigate CVE-2025-59148

Immediate Actions Required

• Upgrade Suricata to version 8.0.1 or later on all sensor deployments running 8.0.0, 8.0.0-beta1, or 8.0.0-rc1.
• Inventory active rule sets and remove or disable any rule using the entropy keyword without a sticky buffer anchor until the upgrade is complete.
• Validate sensor restart and high-availability configurations to limit detection downtime if a crash occurs before patching.

Patch Information

OISF released the fix in Suricata 8.0.1, announced via the Suricata 8.0.1 and 7.0.12 release notes. The code change is available in OISF commit 9f32550e18f97ea5d610dd7c36aab0ba142c096c. Operators using distribution packages should apply the corresponding vendor backport once available.

Workarounds

• Disable all rules that use the entropy keyword until the sensor is upgraded to 8.0.1.
• Edit affected rules to ensure the entropy keyword follows a sticky buffer declaration such as http.uri; entropy:...;.
• Restrict rule authoring privileges so only reviewed rule sets are deployed to production Suricata sensors.

# Identify rules using the entropy keyword without a sticky buffer anchor
grep -RIn 'entropy' /etc/suricata/rules/ \
  | grep -Ev 'http\.|file\.|tls\.|dns\.|ja3\.'

# Verify installed Suricata version after upgrade
suricata --build-info | grep -i 'version'