Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected products
oisf: suricata
References7
- github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586 Vendor Advisory
- github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a… Patch
- github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9… Patch
- github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86… Patch
- github.com/OISF/suricata/releases/tag/suricata-7.0.17 Release Notes
- github.com/OISF/suricata/releases/tag/suricata-8.0.6 Release Notes
- redmine.openinfosecfoundation.org/issues/8558 Permissions Required
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 24 · as of 8 November 2026
- CWE
- CWE-697
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.