CVE-2025-29915

HIGH

Suricata < 7.0.9 - Improper Verification of Cryptographic Signature via AF_PACKET Defrag Option

Title source: llm
STIX 2.1

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0023
EPSS Percentile 13.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-347
Status published
Products (1)
oisf/suricata < 7.0.9
Published Apr 10, 2025
Tracked Since Feb 18, 2026