CVE-2021-45098

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942Release Notes, Vendor Advisory
https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97dfPatch, Third Party Advisory
https://github.com/OISF/suricata/releasesRelease Notes, Third Party Advisory
https://redmine.openinfosecfoundation.org/issues/4710Exploit, Issue Tracking, Patch, Vendor Advisory
https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942Release Notes, Vendor Advisory
https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97dfPatch, Third Party Advisory
https://github.com/OISF/suricata/releasesRelease Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html
https://redmine.openinfosecfoundation.org/issues/4710Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Dec 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450998.8The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requ CVE-2021-451007.5The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has b CVE-2021-451018.1An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user wit CVE-2021-451028.8An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon using a SciToken, a CVE-2021-451038.1An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that CVE-2021-451047.4An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker who can capture HTCondor network data can interf CVE-2021-451055.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referent CVE-2021-451066.5A vulnerability has been identified in SICAM TOOLBOX II (All versions). Affected applications use a circumventable access control within a d CVE-2021-451118.1Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger CVE-2021-451157.5An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred sign CVE-2021-451167.5An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language CVE-2021-451176.5The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.