CVE-2024-37151

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
OISF	suricata	>= 6.0.0, < 6.0.20; >= 7.0.0,< 7.0.6
oisf	suricata	>= 6.0.0, < 6.0.20
oisf	suricata	>= 7.0.0, < 7.0.6

References

Timeline

Published: Jul 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371527.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive sett CVE-2024-371537.5Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is CVE-2024-371545.3Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This CVE-2024-371558.2OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to vers CVE-2024-371566.1The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the CVE-2024-371575.3Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `te CVE-2024-371588.1Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accoun CVE-2024-371596.5Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested CVE-2024-37166.2A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in CVE-2024-371604.8Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scri CVE-2024-371616.1MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting CVE-2024-371625.3zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stac