Stack Overflow Risk in Suricata Network Engine Due to Lua Script Processing

CVE-2025-64344

What is CVE-2025-64344?

A vulnerability exists in the Suricata network IDS, IPS, and NSM engine due to improper handling of large buffers in Lua scripts prior to versions 7.0.13 and 8.0.2. The issue can lead to stack overflow errors when users execute Lua rules or output scripts that pass large buffers, potentially compromising system stability. To mitigate this risk, it is recommended to disable Lua rules and output scripts or set appropriate limits on parameters such as stream.depth.reassembly and HTTP response body limits to ensure they do not exceed half the stack size. Users should upgrade to the latest versions to protect against this vulnerability.

References