« Volver al listado

CVE-2025-53538

Estado: AnalizadaAlta (7.5)—

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de red remota sin autenticación (AV:N, PR:N) que causa consumo descontrolado de memoria en Suricata, provocando denegación de servicio por agotamiento de recursos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Oisf — Suricata

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53538",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53538",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-23T18:32:13.576494Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "OISF",
          "product": "suricata",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.0.11"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0-beta1, < 8.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-22T22:15:37.620",
  "references": [
    {
      "url": "https://github.com/OISF/suricata/commit/1d6d331752e933c46aca0ae7a9679b27462246e3",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OISF/suricata/commit/7fa88ea9e7d05e07a7864050cfd836b576669720",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrr7-crgj-cmh3",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and  8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0."
    },
    {
      "lang": "es",
      "value": "Suricata es un motor de red IDS, IPS y NSM desarrollado por la OISF (Open Information Security Foundation) y la comunidad Suricata. En las versiones 7.0.10 y anteriores, y de la 8.0.0-beta1 a la 8.0.0-rc1, la gestión incorrecta de datos en el flujo HTTP2 0 puede provocar un uso incontrolado de memoria, lo que conlleva pérdida de visibilidad. Las soluciones alternativas incluyen deshabilitar el analizador HTTP/2 y usar una firma como `drop http2 any any -&gt; any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;''), donde la primera prueba de bytes verifica el tipo de trama HTTP2 `DATA'' y la segunda el ID de flujo 0. Esto se ha corregido en las versiones 7.0.11 y 8.0.0."
    }
  ],
  "lastModified": "2026-06-17T09:38:24.567",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DADE1D0-5754-4B63-A0D6-70C52C2882D3",
              "versionEndExcluding": "7.0.11"
            },
            {
              "criteria": "cpe:2.3:a:oisf:suricata:8.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C51F6B1-2B23-4C24-9B69-DA71597628C6"
            },
            {
              "criteria": "cpe:2.3:a:oisf:suricata:8.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "722B8967-EC47-43AF-AB71-4F7487780CED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}