CVE-2026-63449: Suricata SIP Parser Information Disclosure

CVE-2026-63449 Overview

CVE-2026-63449 is a numeric truncation vulnerability [CWE-197] in the Suricata network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The Session Initiation Protocol (SIP) parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. When a SIP body exceeds 65,536 bytes, the length value truncates. This prevents frame:request.body and frame:response.body from exposing the complete body to inspection. Content in the omitted portion can evade frame-based detection rules. The issue affects Suricata versions 8.0.0 through 8.0.5 and is fixed in version 8.0.6.

Critical Impact
Attackers can smuggle malicious content past Suricata frame-based detection by crafting SIP messages with bodies larger than 65,536 bytes.

Affected Products

Suricata 8.0.0 through 8.0.5
Open Information Security Foundation (OISF) Suricata IDS/IPS deployments
Network Security Monitoring environments using SIP frame-based detection rules

Discovery Timeline

2026-09-18 - CVE-2026-63449 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63449

Vulnerability Analysis

The vulnerability resides in Suricata's Rust-based SIP parser located at rust/src/sip/parser.rs. The parser tracks structural offsets and lengths using u16 fields, including request_line_len, headers_len, body_offset, and body_len. The u16 type can represent values only up to 65,535. When a SIP message body exceeds this boundary, the stored length wraps around due to integer truncation.

As a result, frame-based inspection surfaces such as frame:request.body and frame:response.body only expose the truncated portion of the payload. Detection rules that rely on these frames never see the omitted bytes. An adversary can position malicious content past the 65,536-byte boundary to evade signature matching while the traffic still reaches the intended endpoint.

Root Cause

The root cause is improper numeric type selection for length fields storing user-controllable protocol data. SIP bodies can legitimately carry large Session Description Protocol (SDP) payloads and other content, but the parser assumed values would fit within 16 bits. Suricata release 8.0.6 widens the affected fields to u32, eliminating the truncation window for practical payload sizes.

Attack Vector

An attacker with network access to traffic monitored by Suricata sends a SIP request or response with a body larger than 65,536 bytes. Malicious content is placed beyond the truncation boundary. Suricata parses the frame, records the truncated length, and exposes only the initial portion to detection engines. Rules referencing frame:request.body or frame:response.body fail to match content in the hidden segment.

rust

// Suricata patch: rust/src/sip/parser.rs
// Widen SIP frame length fields from u16 to u32 to avoid body truncation.

     pub version: String,
     pub headers: HashMap<String, Vec<String>>,
 
-    pub request_line_len: u16,
-    pub headers_len: u16,
-    pub body_offset: u16,
-    pub body_len: u16,
+    pub request_line_len: u32,
+    pub headers_len: u32,
+    pub body_offset: u32,
+    pub body_len: u32,
     pub body: Option<SdpMessage>,
 }

Source: Suricata Commit 499995b

Detection Methods for CVE-2026-63449

Indicators of Compromise

SIP request or response messages with a declared or observed body length exceeding 65,536 bytes traversing monitored segments.
Discrepancies between SIP Content-Length header values and the byte count Suricata reports for frame:request.body or frame:response.body.
Unusual SDP or media payloads embedded in SIP messages that terminate abruptly in Suricata logs but complete successfully at the SIP endpoint.

Detection Strategies

Inventory Suricata sensors and identify any instance running versions 8.0.0 through 8.0.5 that inspect SIP traffic.
Deploy complementary payload-inspection controls that do not rely solely on Suricata frame-based SIP rules until sensors are patched.
Cross-correlate SIP session records from call session control functions or SIP proxies against Suricata eve.json logs to identify body-size mismatches.

Monitoring Recommendations

Alert on SIP flows carrying oversized bodies, particularly requests with Content-Length values near or above 65,536 bytes.
Monitor Suricata stats.log and application-layer counters for anomalies in SIP parsing metrics after upgrade.
Review historical SIP traffic captures for signs of previously undetected oversized body abuse.

How to Mitigate CVE-2026-63449

Immediate Actions Required

Upgrade all affected Suricata sensors to version 8.0.6 or later, which widens the SIP length fields to u32.
Verify the upgrade by confirming the fixed commits 499995b and 6f87930a are present in the deployed build.
Reload Suricata rules and restart the engine after upgrade to ensure the patched parser is active.

Patch Information

The fix is available in Suricata Release 8.0.6. Details are documented in GitHub Security Advisory GHSA-prqx-q74v-wxhv, Suricata Pull Request #15807, and Open Information Security Foundation Issue #8582.

Workarounds

Where upgrade cannot be immediately applied, augment detection with SIP proxy or session border controller logging that captures full message bodies.
Constrain maximum SIP body size at upstream gateways to values below 65,536 bytes where operationally acceptable.
Supplement frame:request.body and frame:response.body rules with content and pcre matches over the raw stream buffer to reduce reliance on the truncated frame.

bash

# Verify installed Suricata version and confirm the fix is present
suricata --build-info | head -n 5
suricata -V

# Example: constrain SIP body size at an upstream proxy (illustrative)
# set max-sip-body-bytes 65535