CVE-2024-47522

What it actually does

Invalid ALPN values in TLS/QUIC traffic cause Suricata to panic and abort when JA4 matching or logging is enabled.

Why it matters to the business

Network monitoring and intrusion detection stop unexpectedly, creating blind spots in security visibility and potentially interrupting operations until the engine restarts.

How an attack unfolds

An attacker sends specially crafted TLS or QUIC traffic containing an invalid ALPN extension; when the target Suricata instance has JA4 features active, the malformed data triggers an unhandled condition that forces the process to abort.

How to fix it

Upgrade Suricata to version 7.0.7 or later. As a temporary workaround disable the ja4 feature. For typo3/cms-core update to 8.7.48 or 9.5.37 depending on the branch in use.

How to confirm the fix worked

Confirm Suricata version is 7.0.7 or newer, verify ja4 configuration is disabled if not upgraded, and test that crafted ALPN traffic no longer causes a panic.

Typical attack path

1. Identify Suricata deployments with JA4 enabled
2. Craft TLS/QUIC packets containing invalid ALPN values
3. Transmit the traffic toward the monitored network segment
4. Trigger process panic and loss of detection capability

How to detect it

Review Suricata logs for sudden process aborts or panic messages around the time of TLS/QUIC flows; look for unexpected restarts in service monitoring and correlate with JA4-related configuration.

What your security team should do

• Immediately upgrade Suricata to 7.0.7 across all instances
• Temporarily disable ja4 logging and matching until patches are applied
• Add Suricata version checks to routine asset inventory scans
• Monitor for any process restarts or crashes in Suricata logs