CVE-2024-38534highCWE-770

CVE-2024-38534: high-severity vulnerability in OISF suricata

Suricata modbus: txs without responses are never freed

Published · Updated

Follow this CVE+ Monitor suricata+ Monitor suricata

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.9%
In short

Suricata can accumulate unlimited resources when processing specially crafted Modbus network traffic, potentially causing the system to run out of memory or become unresponsive. This happens because incomplete Modbus requests are not properly cleaned up.

Technical detail

Suricata's Modbus parser fails to free transaction structures (txs) when responses are absent, allowing an attacker to send crafted Modbus traffic that triggers unbounded resource accumulation within a flow. The vulnerability is mitigated by limiting stream.reassembly.depth; fixed in version 7.0.6.

Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow. Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricata
Related CVEs — OISF suricata

In the same product, most dangerous first.

CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2024-55627MEDIUMSuricata segfault on StreamingBufferSlideToOffsetWithRegionsEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%