CVE-2026-63447
Description
A flaw was found in Suricata. A remote, unauthenticated attacker can exploit this issue by sending specially crafted File Transfer Protocol (FTP) traffic containing large command sequences, causing the parser to allocate transactions beyond expected limits. Processing this oversized transaction list leads to excessive CPU resource consumption, resulting in degraded packet inspection capabilities and a Denial of Service (DoS).
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker transmitting network traffic inspected by Suricata can trigger severe CPU exhaustion without requiring privileges, leading to packet processing starvation and denial of service. In typical deployments where Suricata passively monitors high-throughput network segments, malicious FTP payloads can degrade inspection performance across all monitored flows. Environments that do not inspect FTP traffic or that strictly filter network access to monitored boundaries experience substantially lower operational risk. Red Hat does not ship versions affected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
