CVE-2025-59149

Name	CVE-2025-59149
Description	Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
suricata (PTS)	bullseye	1:6.0.1-3	fixed
	bullseye (security)	1:6.0.1-3+deb11u1	fixed
	bookworm	1:6.0.10-1	fixed
	trixie	1:7.0.10-1	fixed
	forky, sid	1:8.0.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
suricata	source	(unstable)	(not affected)

Notes

- suricata <not-affected> (Vulnerable code never present in a Debian released version, 8.0.x only issue)
https://github.com/OISF/suricata/security/advisories/GHSA-vxcg-38x4-gj7j
https://github.com/OISF/suricata/commit/38a2cba5c397002047d84645f5ab770ff88020e1 (suricata-8.0.1)
https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
https://redmine.openinfosecfoundation.org/issues/7861