Suricata 8.0.8 fixes high-severity DoS and detection bypasses

Suricata 8.0.8 is out with fixes for a set of high-severity flaws that can exhaust CPU or memory, crash the intrusion detection engine, or let traffic slip past rules.

Victor Julien announced the release on the oss-security list. The six high-severity issues cover unbounded TFTP transaction retention that can burn CPU, quadratic complexity in SIP TCP header processing, HTTP/2 memory exhaustion from Brotli decoders across many streams and from header inspection buffers, a DoH2 xbits track-tx type confusion that can crash Suricata, and FTP retention of preliminary replies that can exhaust memory.

Moderate-severity problems center on detection bypass. Mishandled TCP urgent support, invalid TCP timestamps that desynchronize the stream, an overlap check that can miss non-adjacent segments, and window scale values above 14 treated as zero can all undermine inspection. An incomplete earlier fix for DNS inspection type confusion in DoH2 remains, and a flowbits prefilter can trigger an out-of-bounds write.

No CVE identifiers have been assigned. Julien said requests for the prior release still had not come through, and that the project is considering applying to become its own CNA. Low-severity issues were omitted from the advisory.