Overview
CVE-2025-64331 identifies a high-severity stack overflow vulnerability affecting Suricata, a widely used network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring (NSM) engine. This vulnerability exists in versions prior to 7.0.13 and 8.0.2 and is triggered during large HTTP file transfers when the HTTP response body limit is increased and printable HTTP body logging is enabled.
Technical Details
The root cause of CVE-2025-64331 lies in the way Suricata handles HTTP response body logging. If the HTTP response body limit is increased beyond its default value and the logging of printable HTTP bodies is enabled, a large HTTP file transfer can lead to a stack overflow. This occurs because the allocated buffer on the stack is insufficient to hold the entire logged data. This leads to memory corruption, potentially causing the Suricata process to crash or allowing for arbitrary code execution.
The vulnerability is triggered specifically when:
- The HTTP response body limit is increased by the user.
- HTTP body logging is enabled with the `http-body-printable` option.
- A large HTTP file is transferred, exceeding the stack buffer’s capacity.
CVSS Analysis
This vulnerability has been assigned a CVSS score of 7.5, indicating a high severity. The CVSS vector is likely to include factors related to remote exploitation and potential for system compromise.
- CVSS Score: 7.5 (HIGH)
- Impact: Potential for denial of service (DoS) due to process crash or, in more severe scenarios, arbitrary code execution.
- Exploitability: The vulnerability is remotely exploitable as it involves network traffic processing.
Possible Impact
Successful exploitation of CVE-2025-64331 can have several significant impacts:
- Denial of Service (DoS): A stack overflow can lead to a crash of the Suricata process, disrupting network monitoring and security operations.
- Arbitrary Code Execution: In a more critical scenario, an attacker might be able to leverage the stack overflow to execute arbitrary code on the system running Suricata, potentially leading to complete system compromise.
- Bypass of Security Controls: If Suricata crashes, it can leave the network unprotected, allowing malicious traffic to bypass security controls.
Mitigation and Patch Steps
The recommended mitigation is to upgrade Suricata to version 7.0.13 or 8.0.2, where the vulnerability has been patched.
- Upgrade Suricata: Upgrade to the latest stable version of Suricata (7.0.13 or 8.0.2 or later) as soon as possible. Follow the official Suricata upgrade instructions for your specific operating system and environment.
- Workaround (if immediate upgrade is not possible): If an immediate upgrade is not feasible, consider the following workarounds:
- Use Default HTTP Response Body Limits: Avoid increasing the default HTTP response body limit.
- Disable HTTP Body Logging: Disable the `http-body-printable` logging option. Note that body logging is disabled by default, so only take this action if you have explicitly enabled it.
- Monitor Network Traffic: Continue to monitor network traffic for suspicious activity.
