CVE-2026-63447

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 18, 2026, 8:21:06 PM UTC

Updated

Sep 18, 2026, 9:17:03 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A flaw was found in Suricata. A remote, unauthenticated attacker can exploit this issue by sending specially crafted File Transfer Protocol (FTP) traffic containing large command sequences, causing the parser to allocate transactions beyond expected limits. Processing this oversized transaction list leads to excessive CPU resource consumption, resulting in degraded packet inspection capabilities and a Denial of Service (DoS). This vulnerability is rated as Important because an unauthenticated remote attacker transmitting network traffic inspected by Suricata can trigger severe CPU exhaustion without requiring privileges, leading to packet processing starvation and denial of service. In typical deployments where Suricata passively monitors high-throughput network segments, malicious FTP payloads can degrade inspection performance across all monitored flows. Environments that do not inspect FTP traffic or that strictly filter network access to monitored boundaries experience substantially lower operational risk. Red Hat does not ship versions affected by this vulnerability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.