CVE-2026-63446: Suricata IDS/IPS DOS Vulnerability

CVE-2026-63446 Overview

CVE-2026-63446 is a resource exhaustion vulnerability in Suricata, the open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw exists in AppLayerParserSetTransactionInspectId() within src/app-layer-parser.c and affects Suricata versions from 8.0.0 up to (but not including) 8.0.6. An inverted conditional causes completed application-layer transactions to remain unmarked and never freed on flows handled by a pass rule or pass-the-flow exception policy. The per-flow transaction list grows without bound and incurs quadratic cleanup cost, leading to CPU and memory exhaustion on the sensor. The issue is tracked under [CWE-401] and resolved in Suricata 8.0.6.

Critical Impact
A remote attacker who can send traffic matched by a pass rule can exhaust Suricata's CPU and memory, degrading or disabling network monitoring and inline blocking.

Affected Products

Suricata 8.0.0 through 8.0.5
Sensors configured with pass rules in the ruleset
Deployments using the pass-the-flow exception policy

Discovery Timeline

2026-09-18 - CVE-2026-63446 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63446

Vulnerability Analysis

Suricata tracks application-layer transactions per flow and marks them as inspected once detection completes. The function AppLayerParserSetTransactionInspectId() iterates transactions and sets the APP_LAYER_TX_INSPECTED_TS or APP_LAYER_TX_INSPECTED_TC flag so that finished transactions can be freed. On flows released by a pass rule or a pass-the-flow exception policy, detection is skipped entirely. Combined with an inverted flag check, the effect is that completed transactions are never marked inspected and therefore never garbage-collected.

Each subsequent packet on the flow triggers another walk of the growing transaction list. Cleanup performs work proportional to the square of the list length, so CPU consumption escalates quickly. Memory usage rises in parallel because transaction state is retained indefinitely. A sustained flow can starve the sensor of resources and interrupt monitoring or inline enforcement.

Root Cause

The root cause is a logic inversion in a guard condition [CWE-401]. The code branched into the marking block only when the inspected flag was already set, which is the opposite of the intended behavior. As a result, transactions that had not yet been marked were skipped, keeping them alive on the per-flow list.

Attack Vector

Exploitation requires network reachability to a Suricata sensor whose ruleset contains at least one pass rule or which uses the pass-the-flow exception policy. No authentication or user interaction is required. An attacker generates or induces many application-layer transactions on a matching flow to force unbounded list growth and quadratic cleanup cost.

// Patch from src/app-layer-parser.c - inverted guard corrected
         if (tag_txs_as_inspected) {
             const uint8_t inspected_flag = (flags & STREAM_TOSERVER) ? APP_LAYER_TX_INSPECTED_TS
                                                                      : APP_LAYER_TX_INSPECTED_TC;
-            if (txd->flags & inspected_flag) {
+            if (!(txd->flags & inspected_flag)) {
                 txd->flags |= inspected_flag;
                 SCLogDebug("%p/%" PRIu64 " in-order tx is done for direction %s. Flags %02x", tx,
                         idx, flags & STREAM_TOSERVER ? "toserver" : "toclient", txd->flags);

Source: Suricata Commit 006e21c1

Detection Methods for CVE-2026-63446

Indicators of Compromise

Sustained high CPU utilization on Suricata worker threads with no proportional increase in inspected traffic volume
Growing resident memory of the Suricata process over hours or days without release
stats.log entries showing continuously increasing app_layer.tx counters for flows that match pass rules
Packet drops or capture.kernel_drops growth as worker threads fall behind

Detection Strategies

Inventory active rulesets for pass actions and any exception policy configured with pass-flow, then correlate those flows with sensor performance metrics
Compare Suricata process memory and CPU baselines before and after ruleset changes that introduce pass rules
Alert on Suricata engine restarts, watchdog kills, or systemd out-of-memory events on IDS/IPS hosts

Monitoring Recommendations

Ship Suricata eve.json and stats.log to a central analytics platform and track per-flow transaction counts
Monitor host-level CPU, RSS, and OOM-killer activity on sensors running versions 8.0.0 through 8.0.5
Track packet drop and reassembly failure counters as early indicators of sensor degradation

How to Mitigate CVE-2026-63446

Immediate Actions Required

Upgrade all Suricata deployments running 8.0.0 through 8.0.5 to Suricata 8.0.6
Audit rulesets and remove or narrow overly broad pass rules until the upgrade is completed
Review the exception policy configuration and avoid pass-flow on high-volume traffic classes during the interim

Patch Information

The fix inverts the flag check in AppLayerParserSetTransactionInspectId() so that transactions are marked inspected only when the flag is not already set. The change is included in commits 006e21c1 and 60a83c62, delivered via Pull Request #15726 and released in Suricata 8.0.6. Additional context is provided in GHSA-gjwr-75gq-877m and OISF Issue #8628.

Workarounds

Replace pass rules with narrower drop or alert logic where feasible until patched
Configure exception policies to drop-flow or bypass instead of pass-flow on affected sensors
Restart the Suricata process on a scheduled interval to reclaim retained transaction memory as a temporary control

bash

# Verify installed version and upgrade to a fixed release
suricata --build-info | grep -i version

# Example: build and install Suricata 8.0.6 from source
wget https://github.com/OISF/suricata/releases/download/suricata-8.0.6/suricata-8.0.6.tar.gz
tar -xzf suricata-8.0.6.tar.gz && cd suricata-8.0.6
./configure && make && sudo make install
sudo systemctl restart suricata

# Interim: audit ruleset for pass rules
grep -RE '^\s*pass\s' /etc/suricata/rules/