CVE-2024-32664

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md5` to false.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-120 CWE-122

Affected software

Vendor	Product	Versions
OISF	suricata	>= 6.0.0, <= 6.0.18; >= 7.0.0, <= 7.0.4
oisf	suricata	>= 6.0.0, <= 6.0.18
oisf	suricata	>= 7.0.0, <= 7.0.4

References

Timeline

Published: May 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-326665.5NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial CVE-2024-326673.9Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access.CVE-2024-326688.2An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A CVE-2024-326695.3Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the CVE-2024-32675.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all v CVE-2024-326707.0Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially ident CVE-2024-326719.8Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escarg CVE-2024-326725.3A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of ser CVE-2024-326735.5Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.CVE-2024-326745.4Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitra CVE-2024-326756.5Missing Authorization vulnerability in Xfinity Soft Order Limit for WooCommerce.This issue affects Order Limit for WooCommerce: from n/a thr CVE-2024-326765.3Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functi