CVE-2024-45795: high-severity vulnerability in OISF suricata
Suricata detect/datasets: reachable assertion with unimplemented rule option
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
exploitation probability
0.5%top 57% of all CVEs
observed exploitation
nono source reports it
In short
Suricata can crash when processing network traffic if certain security rules use an unimplemented 'unset' option with datasets. This denial of service affects network monitoring and protection capabilities.
Technical detail
A reachable assertion in Suricata's dataset handling allows remote attackers to trigger a denial of service by sending traffic that matches rules containing the unimplemented 'unset' option. The vulnerability requires the vulnerable rule to be loaded in the active ruleset; impact is availability of the IDS/IPS engine.
Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, rules using datasets with the non-functional / unimplemented "unset" option can trigger an assertion during traffic parsing, leading to denial of service. This issue is addressed in 7.0.7. As a workaround, use only trusted and well tested rulesets.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricataRelated CVEs — OISF suricata
In the same product, most dangerous first.
CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2024-55627MEDIUMSuricata segfault on StreamingBufferSlideToOffsetWithRegionsEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%