CVE-2026-63347
suricata-update vulnerability
No scoreFix available
[Unknown description]
What each source reports
OSVUBUNTU-CVE-2026-63347 No score
[Unknown description]
- Record
UBUNTU-CVE-2026-63347- Updated
- 2026-11-02
OSVUSN-8766-1 No score
suricata-update vulnerability
Guillem Lefait discovered that Suricata-Update did not properly validate destination paths when extracting files referenced by downloaded rule archives. An attacker could possibly use this issue to write arbitrary files outside the configured rules directory.
- Record
USN-8766-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricata-updateDebian:12 |
before 1.2.7-1+deb12u1, plus listed versions 1.2.7-1 |
1.2.7-1+deb12u1 |
suricata-updateDebian:13 |
before 1.3.4-1+deb13u1, plus listed versions 1.3.4-1 |
1.3.4-1+deb13u1 |
suricata-updateDebian:14 |
before 1.3.8-1, plus listed versions 1.3.4-11.3.6-11.3.6-1~exp11.3.7-11.3.7-21.3.7-2~bpo13+11.3.8-1~bpo13+1 |
1.3.8-1 |
suricata-updateUbuntu:Pro:22.04:LTS |
before 1.2.3-1ubuntu0.1~esm1, plus listed versions 1.2.1-11.2.2-11.2.3-1 |
1.2.3-1ubuntu0.1~esm1 |
suricata-updateUbuntu:Pro:24.04:LTS |
before 1.3.0-2ubuntu0.1~esm1, plus listed versions 1.3.0-11.3.0-2 |
1.3.0-2ubuntu0.1~esm1 |
suricata-updateUbuntu:Pro:26.04:LTS |
before 1.3.7-2ubuntu0.1~esm1, plus listed versions 1.3.4-11.3.6-11.3.7-11.3.7-2 |
1.3.7-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-63347 is a vulnerability with no CVSS score yet in suricata-update, published August 17, 2026. No source lists public exploit code. Fixed in suricata-update 1.2.7-1+deb12u1.