CVE-2024-55605

What it actually does

Large input buffers passed to to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor transforms cause a stack overflow that crashes the Suricata process.

Why it matters to the business

Crashes can interrupt network intrusion detection, prevention, and monitoring, creating windows of exposure until the engine restarts and potentially requiring repeated manual intervention.

How an attack unfolds

An attacker crafts network traffic containing oversized payloads that reach one of the listed transform functions during inspection; the oversized buffer overflows the stack and terminates Suricata.

How to fix it

Upgrade oisf/suricata to version 7.0.8 or apply commit 97e69ffb1bc2b7358115ee59f460a924893664e8; rebuild and restart all instances after the update.

How to confirm the fix worked

Confirm the running binary reports version 7.0.8 or later; replay test traffic containing large transform inputs and verify the process no longer crashes.

Typical attack path

1. Identify Suricata deployments performing deep packet inspection on reachable traffic paths
2. Craft or replay packets that trigger one of the vulnerable transforms with an excessively large buffer
3. Send the traffic to induce the stack overflow and crash the engine
4. Repeat as needed to maintain denial of service on monitoring capabilities

How to detect it

Monitor Suricata process logs and system crash reports for abrupt terminations while handling traffic that exercises string transforms; correlate restarts with spikes in inspected traffic volume.

What your security team should do

• Upgrade all Suricata instances to the fixed version or commit immediately
• Add Suricata process crash and restart alerts to monitoring dashboards
• Review and test inspection rules that invoke the listed transforms with variable-length data