CVE-2025-29917
📋 TL;DR
Suricata's decode_base64 keyword has insufficient memory allocation limits, allowing attackers to trigger excessive memory consumption up to 4GB per thread via specially crafted signatures. This affects all Suricata deployments using vulnerable versions with signatures containing the decode_base64 keyword. The vulnerability can lead to denial of service through resource exhaustion.
💻 Affected Systems
- Suricata IDS/IPS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to denial of service, potentially crashing Suricata and disrupting network security monitoring across all protected systems.
Likely Case
Degraded performance or temporary service disruption as memory allocation spikes impact Suricata's ability to process network traffic.
If Mitigated
Minimal impact with proper signature validation and memory limits in place, though some performance degradation may still occur during attack attempts.
🎯 Exploit Status
Exploitation requires sending network traffic that triggers vulnerable signatures. No authentication needed as Suricata processes all monitored traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.9
Vendor Advisory: https://github.com/OISF/suricata/security/advisories/GHSA-x8c9-8553-j9px
Restart Required: Yes
Instructions:
1. Download Suricata 7.0.9 from official sources. 2. Stop Suricata service. 3. Backup configuration and rules. 4. Install new version. 5. Restart Suricata service. 6. Verify functionality.
🔧 Temporary Workarounds
Disable decode_base64 signatures
allRemove or disable any signatures using the decode_base64 keyword with bytes setting
suricata -T --dump-config | grep -i base64
Review and modify rules files to remove vulnerable signatures
Implement memory limits
linuxConfigure system memory limits for Suricata process to contain impact
ulimit -v 1073741824
systemctl edit suricata (add MemoryMax=1G)
🧯 If You Can't Patch
- Review and remove all signatures using decode_base64 keyword with bytes parameter
- Implement network segmentation to limit Suricata's exposure to untrusted traffic
🔍 How to Verify
Check if Vulnerable:
Check Suricata version and review signatures for decode_base64 usage: suricata --build-info | grep Version && grep -r 'decode_base64' /etc/suricata/rules/Check Version:
suricata --build-info | grep VersionVerify Fix Applied:
Confirm version is 7.0.9 or later: suricata --build-info | grep 'Version: 7\.0\.9'📡 Detection & Monitoring
Log Indicators:
- Suricata process crashes or restarts
- High memory usage alerts
- Performance degradation in network monitoring
Network Indicators:
- Unusual base64-encoded payloads in network traffic
- Traffic patterns designed to trigger specific signatures
SIEM Query:
source="suricata" AND ("out of memory" OR "segmentation fault" OR memory>90%)