Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve configuration. The setting is disabled by default.
Weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Suricata | Oisf | * | 7.0.14 (excluding) |
| Suricata | Oisf | 8.0.0 (including) | 8.0.3 (excluding) |
| Suricata | Ubuntu | upstream | * |