CVE-2024-55627

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer underflow. The issue has been addressed in Suricata 7.0.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122 CWE-191 CWE-787

Affected software

Vendor	Product	Versions
OISF	suricata	< 7.0.8

References

Timeline

Published: Jan 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-556287.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8 CVE-2024-556297.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP st CVE-2024-55634.8Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. Thi CVE-2024-556305.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's CVE-2024-556317.8An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations CVE-2024-556327.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2024-556336.5Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially CVE-2024-556348.1A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.CVE-2024-556356.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site S CVE-2024-556369.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556379.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.CVE-2024-556389.8Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102