PT-2024-10009 · Suricata+2 · Suricata+2

Victorjulien · Published 2024-12-12 · Updated 2025-11-07 · CVE-2024-55628

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.8

Description The issue is related to asymmetric resource consumption due to incorrect compression of DNS resource names when processing DNS messages. This can be exploited by a remote attacker to cause a denial of service. The problem arises when small DNS messages contain very large hostnames, which can be costly to decode and lead to very large DNS log records. Although limits are in place, they were too generous, allowing for potential exploitation.

Recommendations For Suricata versions prior to 7.0.8, update to version 7.0.8 to address the issue. As a temporary workaround, consider restricting the size of DNS messages or limiting the decoding of large hostnames to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-405

CWE-779

Related Identifiers

ALT-PU-2025-14099

BDU:2025-00136

CVE-2024-55628

GHSA-96W4-JQWF-QX2J

OPENSUSE-SU-2025:15394-1

Affected Products

Alt Linux

Debian

Suricata

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55628.json · Exploit
• https://github.com/OISF/suricata/security/advisories/GHSA-96w4-jqwf-qx2j · Vendor Advisory
• https://github.com/OISF/suricata/commit/19cf0f81335d9f787d587450f7105ad95a648951 · Patch
• https://github.com/OISF/suricata/commit/37f4c52b22fcdde4adf9b479cb5700f89d00768d · Patch
• https://github.com/OISF/suricata/commit/3a5671739f5b25e5dd973a74ca5fd8ea40e1ae2d · Patch
• https://ubuntu.com/security/CVE-2024-55628 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55628 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15394-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-55628 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00136 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-55628 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-55628 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-55628 · Security Note
• https://suse.com/security/cve/CVE-2024-47188 · Note