CVE-2025-64332
📋 TL;DR
A stack overflow vulnerability in Suricata's SWF decompression feature can cause the IDS/IPS engine to crash when processing malicious SWF files. This affects Suricata installations with SWF decompression enabled, potentially disrupting network security monitoring. The vulnerability is present in versions before 7.0.13 and 8.0.2.
💻 Affected Systems
- Suricata IDS/IPS/NSM Engine
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service of Suricata, leaving network traffic unmonitored and unprotected from other threats while the service is down.
Likely Case
Suricata crashes when processing specially crafted SWF files, requiring manual restart and causing temporary security monitoring gaps.
If Mitigated
No impact if SWF decompression is disabled or patched versions are deployed.
🎯 Exploit Status
Exploitation requires sending malicious SWF files through monitored network traffic with SWF decompression enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.13 or 8.0.2
Vendor Advisory: https://github.com/OISF/suricata/security/advisories/GHSA-p32q-7wcp-gv92
Restart Required: Yes
Instructions:
1. Download Suricata 7.0.13 or 8.0.2 from official sources. 2. Stop Suricata service. 3. Install/upgrade to patched version. 4. Restart Suricata service.
🔧 Temporary Workarounds
Disable SWF decompression
allDisable the vulnerable SWF decompression feature in Suricata configuration
Edit suricata.yaml and set: swf-decompression: no
Or set decompress-depth: 0
🧯 If You Can't Patch
- Disable SWF decompression in suricata.yaml configuration
- Implement network filtering to block SWF files at perimeter if SWF decompression must remain enabled
🔍 How to Verify
Check if Vulnerable:
Check Suricata version with 'suricata --build-info' and verify if SWF decompression is enabled in suricata.yamlCheck Version:
suricata --build-info | grep VersionVerify Fix Applied:
Confirm version is 7.0.13 or higher for 7.x branch, or 8.0.2 or higher for 8.x branch📡 Detection & Monitoring
Log Indicators:
- Suricata crash logs
- Segmentation fault errors in system logs
- Service restart messages
Network Indicators:
- Sudden drop in Suricata alerts
- SWF files with unusual characteristics
SIEM Query:
source="suricata" AND ("segmentation fault" OR "crash" OR "SIGSEGV")