Network Intrusion Prevention System SMB Parser Vulnerability in Suricata by Open Information Security Foundation

CVE-2026-63448

What is CVE-2026-63448?

Suricata, a network intrusion detection and prevention system, suffers from a vulnerability due to improper handling of force-completed transactions in its SMB parser. When processing one-directional SMB traffic, the parser can create transactions that exceed the SMB_MAX_TX limit, leading to unbounded growth in per-flow state. This situation can consume excessive CPU and memory resources, degrading performance and potentially leading to denial of service. The issue is resolved in versions 7.0.17 and 8.0.6.

References