CVE-2026-63448

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.17 Suricata versions prior to 8.0.6

Description The SMB parser can retain force-completed transactions on flows where payload is seen in only one direction, including async-oneside flows, as the cleanup process waits for inspection in the unseen direction. Transaction creation paths in rust/src/smb can exceed the SMB MAX TX bound, causing the cleanup process to repeatedly scan an increasing list. Consequently, sustained one-directional SMB traffic can lead to unbounded per-flow state and exhaustion of CPU and memory resources.

Recommendations Update to version 7.0.17 or later. Update to version 8.0.6 or later.