CVE-2025-59147

HIGH EPSS 26.3%
Published Oct 1, 20259mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Oct 1, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago

Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
26.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-358

Affected Products 4

VendorProductVersionRange
oisfsuricata* <7.0.12
oisfsuricata8.0.0any
oisfsuricata8.0.0any
oisfsuricata8.0.0any

References 4

  • forum.suricata.io https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
    Release Notes
  • github.com https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b
    Patch
  • github.com https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e
    Patch
  • github.com https://github.com/OISF/suricata/security/advisories/GHSA-v8hv-6v7x-4c2r
    Issue TrackingThird Party Advisory

Remediation

  • github.com https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b
    Patch
  • github.com https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e
    Patch