CVE-2024-55628highCWE-405CWE-779

CVE-2024-55628: high-severity vulnerability in OISF suricata

Suricata oversized resource names utilizing DNS name compression can lead to resource starvation

Published

Follow this CVE+ Monitor suricata+ Monitor suricata

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
In short

Suricata's DNS parser can be tricked using compression techniques to create extremely large hostnames from tiny messages, causing the system to waste resources decoding them and generating oversized log files. This can slow down or crash the security monitoring system.

Technical detail

DNS name compression exploitation allows remote attackers to craft small DNS packets containing compressed pointers that expand into very large hostnames, bypassing insufficient resource limits and causing denial of service through CPU and memory exhaustion during DNS packet decoding and logging operations.

Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name compression can lead to small DNS messages containing very large hostnames which can be costly to decode, and lead to very large DNS log records. While there are limits in place, they were too generous. The issue has been addressed in Suricata 7.0.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricata
Related CVEs — OISF suricata

In the same product, most dangerous first.

CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2024-55627MEDIUMSuricata segfault on StreamingBufferSlideToOffsetWithRegionsEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%