CVE-2024-37151
Suricata defrag: IP ID reuse can lead to policy bypass
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 11, 2024
- Updated
- Nov 3, 2025
- Reserved
- Jun 3, 2024
Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | GitHub_M |
Weaknesses
- CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected Products
| Product | Versions |
|---|---|
suricataOISF |
|
References
- https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24
- https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0
- https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b
- https://redmine.openinfosecfoundation.org/issues/7041
- https://redmine.openinfosecfoundation.org/issues/7042
- https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.