Network Intrusion Detection System Vulnerability in Suricata FTP Parser

CVE-2026-63447

What is CVE-2026-63447?

The Suricata network intrusion detection and prevention system has a vulnerability in its FTP parser (located in src/app-layer-ftp.c) that may allow attackers to exploit the system. When handling large FTP command data, the parser can allocate transactions even after it has reached the specified limit of app-layer.protocols.ftp.max-tx. This can lead to an unbounded increase in transaction processing, resulting in a performance degradation characterized by quadratic complexity. Subsequently, this issue can compromise packet processing capabilities, reducing visibility during monitoring activities or potentially leading to a denial of service. The issue has been rectified in Suricata version 8.0.6, urging users to update to this version to maintain robust network safeguards.

References