CVE-2026-63450: Suricata FTP Parser DOS Vulnerability

CVE-2026-63450 Overview

CVE-2026-63450 affects Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw resides in the File Transfer Protocol (FTP) parser located in src/app-layer-ftp.c. When a client issues a RETR or STOR command before completing PORT or PASV negotiation, the parser treats the condition as a fatal application-layer error rather than a recoverable protocol event. This fatal state disables FTP application-layer parsing for the remainder of the TCP flow. The issue is fixed in Suricata version 8.0.6.

Critical Impact
Attackers can send an out-of-order FTP command to disable FTP application-layer parsing on a flow, evading parser-dependent detection rules and logging in IDS mode, or triggering flow drops in IPS mode.

Affected Products

Suricata IDS/IPS engine versions prior to 8.0.6
Network sensors and NSM deployments using vulnerable Suricata builds
Security appliances and distributions that embed Suricata as their detection engine

Discovery Timeline

2026-09-18 - CVE-2026-63450 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63450

Vulnerability Analysis

Suricata's FTP application-layer parser tracks protocol state to interpret data-channel commands. When a client sends RETR (retrieve) or STOR (store) before negotiating a data channel via PORT or PASV, the parser previously escalated the condition to a fatal error. This is classified under [CWE-755] (Improper Handling of Exceptional Conditions).

Once Suricata marks the FTP flow as fatally errored, application-layer parsing is disabled for the remainder of the Transmission Control Protocol (TCP) flow. Any subsequent FTP commands and responses in that flow are no longer inspected by rules that depend on FTP protocol keywords or FTP application-layer events. Logging of FTP transactions also stops. In IPS mode, the parser reaction is even more disruptive: the entire flow is dropped, producing an availability side effect on legitimate FTP sessions that happen to trigger the same code path.

Root Cause

The root cause is incorrect classification of a recoverable protocol ordering anomaly as a fatal parser error. The FTP parser lacked distinct application-layer events for the two related conditions (a file transfer command before port negotiation, and a file transfer without a name). Instead, it collapsed them into a fatal state that terminated protocol tracking rather than emitting an event and continuing to parse subsequent commands.

Attack Vector

An attacker with the ability to send FTP traffic through a Suricata sensor can craft a single out-of-order FTP session that issues RETR or STOR prior to PORT or PASV. In IDS mode, this disables downstream FTP parsing and lets follow-on commands evade signature and logging coverage. In IPS mode, the same trigger drops the flow, which an attacker can use to disrupt legitimate FTP sessions matching the pattern.

text

// Patch: rules/ftp-events.rules — new events replace the fatal error path
+alert ftp any any -> any any (msg:"SURICATA FTP file before port"; app-layer-event:ftp.file_before_port; classtype:protocol-command-decode; sid:2232003; rev:1;)
+alert ftp any any -> any any (msg:"SURICATA FTP file without name"; app-layer-event:ftp.file_without_name; classtype:protocol-command-decode; sid:2232004; rev:1;)
// Source: https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18

Detection Methods for CVE-2026-63450

Indicators of Compromise

FTP flows where RETR or STOR appears before any PORT or PASV command in the control channel
Sudden cessation of FTP application-layer events or eve.json FTP transaction logs mid-flow on a Suricata sensor
In IPS mode, unexpected flow drops on FTP sessions coinciding with malformed command ordering

Detection Strategies

Deploy the new Suricata rules sid:2232003 (ftp.file_before_port) and sid:2232004 (ftp.file_without_name) shipped with the fix to alert on the anomalous ordering.
Correlate FTP control-channel PCAPs against Suricata eve.json output to identify flows where parsing halted prematurely.
Hunt for FTP sessions with early RETR/STOR commands across historical network telemetry to identify prior evasion attempts.

Monitoring Recommendations

Monitor Suricata stats.log for increases in FTP parser errors and disabled-flow counters.
Track version inventory across all Suricata sensors to confirm none are running builds prior to 8.0.6.
Alert on gaps in FTP transaction logging where TCP flow records show continued traffic without corresponding application-layer events.

How to Mitigate CVE-2026-63450

Immediate Actions Required

Upgrade all Suricata deployments to version 8.0.6 or later, which reclassifies the condition as a recoverable event.
Reload rulesets to include the new ftp.file_before_port and ftp.file_without_name application-layer event signatures.
Review recent FTP traffic for signs of exploitation attempts and validate that FTP logging remained intact across long-lived flows.

Patch Information

The fix is delivered in the Suricata 8.0.6 release. The relevant code changes are captured in Suricata commit 52490b8 and Suricata commit feb0ff9, with the coordinating advisory published as GHSA-56wx-7hqh-wfgr and tracked as Open Information Security Foundation issue #8659. The patch introduces two dedicated FTP events, FtpEventFileBeforePort and FtpEventFileWithoutName, so that the parser continues processing subsequent commands rather than terminating the flow.

Workarounds

If immediate upgrade is not possible, add compensating rules on adjacent sensors or firewalls to alert on FTP RETR or STOR prior to PORT or PASV negotiation.
In IPS mode, evaluate whether temporarily switching affected sensors to IDS mode is acceptable to avoid drop-based disruption of legitimate flows.
Restrict FTP traffic to trusted network segments and require Transport Layer Security (TLS) wrappers where feasible to reduce attacker reach.

bash

# Verify Suricata version and upgrade if below 8.0.6
suricata --build-info | grep -i "^This is Suricata version"

# Example upgrade (source build)
wget https://github.com/OISF/suricata/releases/download/suricata-8.0.6/suricata-8.0.6.tar.gz
tar -xzf suricata-8.0.6.tar.gz && cd suricata-8.0.6
./configure && make && sudo make install

# Reload rules to activate new FTP events
sudo suricatasc -c "reload-rules"