CVE-2026-63450

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.6

Description The FTP parser in src/app-layer-ftp.c incorrectly handles RETR or STOR commands when they are sent before PORT or PASV negotiation. Instead of treating this as a recoverable protocol event, the system marks it as a fatal application-layer error. This fatal state disables FTP application-layer parsing for the rest of the TCP flow, allowing subsequent commands to bypass parser-dependent rules and logging. In IPS mode, the system drops the flow entirely.

Recommendations Update to version 8.0.6.