CVE-2024-45796
Suricata defrag: off by one can lead to policy bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Suricata defrag: off by one can lead to policy bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-193
- Updated
- 2026-11-02
EUVDEUVD-2024-41604
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
EUVD-2024-41604- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
NVD
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-193
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-45796
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
ALPINE-CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSV
Suricata defrag: off by one can lead to policy bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-193
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-45796
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
DEBIAN-CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-45796
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error during fragment reassembly can lead to failed reassembly for valid traffic. An attacker could craft packets to trigger this behavior.This issue has been addressed in 7.0.7.
- Record
UBUNTU-CVE-2024-45796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0181 No score
Updated suricata packages fix security vulnerabilities
Various security, performance, accuracy, and stability issues have been fixed, plus we have moved to a supported version.
- Record
MGASA-2026-0181- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15394-1 No score
libsuricata8_0_0-8.0.0-1.1 on GA media
These are all security issues fixed in the libsuricata8_0_0-8.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15394-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricataAlpine:v3.20 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.21 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.22 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.23 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.24 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataDebian:13 |
before 1:7.0.7-1 | 1:7.0.7-1 |
suricataDebian:14 |
before 1:7.0.7-1 | 1:7.0.7-1 |
suricataDebian:11 From an advisory covering 7 CVEs |
before 1:6.0.1-3+deb11u1, plus listed versions 1:6.0.1-3 |
1:6.0.1-3+deb11u1 |
suricataMageia:9 From an advisory covering 14 CVEs |
before 7.0.10-1.mga9 | 7.0.10-1.mga9 |
suricataUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.8-1build12.0.9-12.0.10-12.0.10-22.0.11-13.0-1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
suricataUbuntu:18.04:LTS |
All versions, plus listed versions 3.2-2ubuntu3 |
None known |
suricataUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0.4-21:6.0.4-3 |
None known |
suricataUbuntu:24.04:LTS |
All versions, plus listed versions 1:7.0.0-21:7.0.2-11:7.0.2-1build11:7.0.3-1build11:7.0.3-1build3 |
None known |
suricataUbuntu:25.10 |
All versions, plus listed versions 1:7.0.8-21:7.0.10-1 |
None known |
suricataUbuntu:26.10 |
All versions, plus listed versions 1:8.0.3-11:8.0.5-11:8.0.6-1 |
None known |
suricataUbuntu:26.04:LTS |
All versions, plus listed versions 1:7.0.10-11:8.0.1-3build11:8.0.2-11:8.0.2-1build11:8.0.3-1 |
None known |
suricataopenSUSE:Tumbleweed From an advisory covering 30 CVEs |
before 8.0.0-1.1 | 8.0.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45796 is a medium vulnerability (CVSS 5.3) in Oisf Suricata, published October 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in suricata 7.0.7-r0.
References
github.com/OISF/suricata/security/advisories/GHSA-mf6r-3xp2-v7xg
redmine.openinfosecfoundation.org/issues/7067
lists.debian.org/debian-lts-announce/2025/03/msg00029.html
security.alpinelinux.org/vuln/CVE-2024-45796
nvd.nist.gov/vuln/detail/CVE-2024-45796
Show 41 moreShow less
security-tracker.debian.org/tracker/CVE-2024-45796
advisories.mageia.org/MGASA-2026-0181.html
bugs.mageia.org/show_bug.cgi?id=33666
lists.fedoraproject.org/archives/list/[email protected]/message/WUPZOFSY4QOLJUU5AJZ7K6EES56A4KEN
forum.suricata.io/t/suricata-6-is-now-end-of-life-eol/4790
ubuntu.com/security/CVE-2024-45796
cve.org/CVERecord?id=CVE-2024-45796
suse.com/security/cve/CVE-2016-10728