CVE-2025-29915: high-severity vulnerability in OISF suricata
Suricata af-packet: defrag option can lead to truncated packets affecting visibility
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.3%
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
OISF · suricataRelated CVEs — OISF suricata
In the same product, most dangerous first.
CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2024-55627MEDIUMSuricata segfault on StreamingBufferSlideToOffsetWithRegionsEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%