CVE-2026-63447: Suricata FTP Parser DOS Vulnerability

CVE-2026-63447 Overview

CVE-2026-63447 is a denial of service vulnerability in Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine maintained by the Open Information Security Foundation (OISF). The flaw resides in the File Transfer Protocol (FTP) parser at src/app-layer-ftp.c. Versions from 8.0.5 up to (but not including) 8.0.6 allow transaction allocation to continue past the configured app-layer.protocols.ftp.max-tx limit when a single large chunk of FTP command data is processed. Repeated quadratic-complexity iteration over the oversized transaction list degrades packet processing performance. The issue is tracked under [CWE-407: Inefficient Algorithmic Complexity] and is fixed in Suricata 8.0.6.

Critical Impact
Crafted FTP traffic can exhaust CPU resources on Suricata sensors, reducing monitoring visibility and enabling attackers to obscure follow-on network activity from detection.

Affected Products

Suricata 8.0.5
Suricata versions prior to 8.0.6 (from the 8.0.5 release)
Deployments using the FTP application-layer parser

Discovery Timeline

2026-09-18 - CVE-2026-63447 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63447

Vulnerability Analysis

The defect lies in how the Suricata FTP application-layer parser enforces the app-layer.protocols.ftp.max-tx transaction cap. The cap is intended to bound resource usage per flow by limiting how many FTPTransaction structures a single flow can produce. When one large chunk of FTP command data is processed, the parser continues allocating new transactions beyond that cap. After the too_many_transactions event fires, the parser still walks the growing transaction list on each subsequent parse iteration, producing quadratic O(n²) work relative to the number of transactions. The result is elevated CPU consumption on the sensor. During the slowdown, packet inspection latency grows and packets may be dropped from the analysis pipeline, reducing network monitoring visibility.

Root Cause

The root cause is missing early-return logic in the transaction allocation path of src/app-layer-ftp.c. When the max-tx threshold is reached, the function should stop allocating and place the flow in an error state. Instead, execution fell through to FTPCalloc(1, sizeof(*tx)), producing an unbounded transaction list that later scan operations traverse repeatedly.

Attack Vector

Exploitation requires only network reachability to a monitored FTP flow. No authentication or user interaction is required. An attacker sends crafted FTP traffic containing a large chunk of command data structured to force many transaction allocations within a single flow. The sensor's CPU load grows quadratically as the parser reprocesses the oversized list, degrading detection across all monitored traffic on the affected sensor.

// Patch: src/app-layer-ftp.c — halt transaction creation once max-tx is reached
                break;
            }
        }
+        return NULL;
    }
    FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));
    if (tx == NULL) {

Source: Suricata commit 15bf91c

Detection Methods for CVE-2026-63447

Indicators of Compromise

Suricata log entries containing the too_many_transactions event on FTP flows
Sustained high CPU utilization on Suricata worker threads correlated with FTP traffic
Growing packet drop counters (capture.kernel_drops) in stats.log during FTP sessions
FTP flows containing unusually large single command chunks or malformed command sequences from a single source

Detection Strategies

Query Suricata eventlog or eve.json for event_type: "anomaly" records where anomaly.event equals too_many_transactions and app_proto is ftp
Alert on sustained sensor CPU above baseline correlated with a rise in FTP flow volume from a single client
Track stats.log deltas for app_layer.tx.ftp counters growing disproportionately to session count

Monitoring Recommendations

Baseline normal FTP transaction rates per flow and alert on statistical outliers
Forward Suricata stats.log and eve.json to a centralized analytics platform for correlation
Monitor packet capture drop rates as a leading indicator of sensor saturation
Track the installed Suricata version across all sensors to confirm patch coverage

How to Mitigate CVE-2026-63447

Immediate Actions Required

Upgrade all Suricata deployments running 8.0.5 to version 8.0.6 or later
Inventory sensors to confirm the FTP parser is enabled in suricata.yaml under app-layer.protocols.ftp
Review sensor telemetry for prior too_many_transactions events that may indicate earlier probing
Validate detection coverage was not degraded during any recent CPU-exhaustion windows

Patch Information

The fix is included in Suricata release 8.0.6. The corrective commits are 15bf91c and 82c4190. After the max-tx limit is reached, the allocator now returns NULL and the flow is moved to an error state, preventing further transaction growth. Full advisory details are available in GHSA-w394-3g33-3jg9 and OISF issue #8592.

Workarounds

If immediate upgrade is not possible, disable the FTP application-layer parser in suricata.yaml
Lower app-layer.protocols.ftp.max-tx to reduce the amplification factor while patching
Use upstream network filtering to restrict FTP traffic reaching monitored segments to trusted hosts

bash

# suricata.yaml — temporary mitigation until upgrade to 8.0.6
app-layer:
  protocols:
    ftp:
      enabled: no
      # Or, if FTP visibility must be preserved, cap max-tx aggressively:
      # enabled: yes
      # memcap: 64mb
      # max-tx: 1024