CVE-2024-55628

What it actually does

DNS name compression handling permits small messages to expand into very large hostnames during decoding, exceeding intended resource limits and producing oversized log records.

Why it matters to the business

Suricata deployments may experience resource exhaustion or log-volume spikes that degrade network monitoring availability and increase storage costs.

How an attack unfolds

An attacker sends crafted DNS traffic containing overly compressed resource names that decode into large hostnames, forcing the engine to consume excessive CPU and generate large log entries.

How to fix it

Upgrade oisf/suricata to the version containing commit 97e69ffb1bc2b7358115ee59f460a924893664e8 (version 7.0.8) and review any custom DNS-related limits.

How to confirm the fix worked

Confirm Suricata reports version 7.0.8 or later, replay test DNS traffic with compressed names, and verify that log record sizes remain bounded.

Typical attack path

1. Locate networks monitored by Suricata
2. Craft DNS messages with aggressive name compression
3. Inject the messages into observed traffic flows
4. Trigger repeated decoding and logging operations

How to detect it

Review Suricata DNS event logs for unusually large hostname fields or spikes in decoding time; correlate with network captures showing compressed DNS responses.

What your security team should do

• Apply the 7.0.8 update or the referenced commit immediately on all instances
• Monitor EPSS and KEV status for any change in exploit availability
• Tune DNS logging filters to cap record size as a temporary control