CVE-2025-59150

Name	CVE-2025-59150
Description	Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
suricata (PTS)	bullseye	1:6.0.1-3	fixed
	bullseye (security)	1:6.0.1-3+deb11u1	fixed
	trixie	1:7.0.10-1+deb13u4	fixed
	forky, sid	1:8.0.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
suricata	source	(unstable)	(not affected)

Notes

- suricata <not-affected> (Vulnerable code never present in a Debian released version, 8.0.x only issue)
https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3
https://github.com/OISF/suricata/commit/d590fdfe42e995fd558315f0c24f9a352e21479d (suricata-8.0.1)
https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
https://redmine.openinfosecfoundation.org/issues/7881