CVE-2024-47187
Suricata datasets: missing hashtable random seed leads to potential DoS
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.5
Suricata datasets: missing hashtable random seed leads to potential DoS
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
EUVDEUVD-2024-42303
7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
EUVD-2024-42303- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
NVD
7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-330, CWE-327
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-47187
7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
ALPINE-CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
7.5
Suricata datasets: missing hashtable random seed leads to potential DoS
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-47187
7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
DEBIAN-CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-47187
7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
- Record
UBUNTU-CVE-2024-47187- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0181 No score
Updated suricata packages fix security vulnerabilities
Various security, performance, accuracy, and stability issues have been fixed, plus we have moved to a supported version.
- Record
MGASA-2026-0181- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15394-1 No score
libsuricata8_0_0-8.0.0-1.1 on GA media
These are all security issues fixed in the libsuricata8_0_0-8.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15394-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricataAlpine:v3.20 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.21 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.22 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.23 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataAlpine:v3.24 |
before 7.0.7-r0 | 7.0.7-r0 |
suricataDebian:13 |
before 1:7.0.7-1 | 1:7.0.7-1 |
suricataDebian:14 |
before 1:7.0.7-1 | 1:7.0.7-1 |
suricataMageia:9 From an advisory covering 14 CVEs |
before 7.0.10-1.mga9 | 7.0.10-1.mga9 |
suricataUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.8-1build12.0.9-12.0.10-12.0.10-22.0.11-13.0-1 |
None known |
suricataUbuntu:18.04:LTS |
All versions, plus listed versions 3.2-2ubuntu3 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
suricataUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0.4-21:6.0.4-3 |
None known |
suricataUbuntu:24.04:LTS |
All versions, plus listed versions 1:7.0.0-21:7.0.2-11:7.0.2-1build11:7.0.3-1build11:7.0.3-1build3 |
None known |
suricataUbuntu:25.10 |
All versions, plus listed versions 1:7.0.8-21:7.0.10-1 |
None known |
suricataUbuntu:26.10 |
All versions, plus listed versions 1:8.0.3-11:8.0.5-11:8.0.6-1 |
None known |
suricataUbuntu:26.04:LTS |
All versions, plus listed versions 1:7.0.10-11:8.0.1-3build11:8.0.2-11:8.0.2-1build11:8.0.3-1 |
None known |
suricataopenSUSE:Tumbleweed From an advisory covering 30 CVEs |
before 8.0.0-1.1 | 8.0.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47187 is a high vulnerability (CVSS 7.5) in Oisf Suricata, published October 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in suricata 7.0.7-r0.
References
github.com/OISF/suricata/security/advisories/GHSA-64ww-4f6x-863p
redmine.openinfosecfoundation.org/issues/7209
security.alpinelinux.org/vuln/CVE-2024-47187
github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47187.json
nvd.nist.gov/vuln/detail/CVE-2024-47187
security-tracker.debian.org/tracker/CVE-2024-47187
Show 40 moreShow less
advisories.mageia.org/MGASA-2026-0181.html
bugs.mageia.org/show_bug.cgi?id=33666
lists.fedoraproject.org/archives/list/[email protected]/message/WUPZOFSY4QOLJUU5AJZ7K6EES56A4KEN
forum.suricata.io/t/suricata-6-is-now-end-of-life-eol/4790
forum.suricata.io/t/suricata-7-0-10-released/5522
forum.suricata.io/t/suricata-7-0-9-released/5495
forum.suricata.io/t/suricata-7-0-8-released/5137
forum.suricata.io/t/suricata-7-0-7-released/4877
ubuntu.com/security/CVE-2024-47187
cve.org/CVERecord?id=CVE-2024-47187
suse.com/security/cve/CVE-2016-10728
suse.com/security/cve/CVE-2018-14568
suse.com/security/cve/CVE-2019-10050
suse.com/security/cve/CVE-2019-10053
suse.com/security/cve/CVE-2024-23835
suse.com/security/cve/CVE-2024-23836
suse.com/security/cve/CVE-2024-23839
suse.com/security/cve/CVE-2024-24568
suse.com/security/cve/CVE-2024-32663
suse.com/security/cve/CVE-2024-32664
suse.com/security/cve/CVE-2024-32867
suse.com/security/cve/CVE-2024-37151
suse.com/security/cve/CVE-2024-38534
suse.com/security/cve/CVE-2024-38535
suse.com/security/cve/CVE-2024-38536
suse.com/security/cve/CVE-2024-45795
suse.com/security/cve/CVE-2024-45796
suse.com/security/cve/CVE-2024-45797
suse.com/security/cve/CVE-2024-47187
suse.com/security/cve/CVE-2024-47188
suse.com/security/cve/CVE-2024-47522
suse.com/security/cve/CVE-2024-55605
suse.com/security/cve/CVE-2024-55626
suse.com/security/cve/CVE-2024-55627
suse.com/security/cve/CVE-2024-55628
suse.com/security/cve/CVE-2024-55629
suse.com/security/cve/CVE-2025-29915
suse.com/security/cve/CVE-2025-29916
suse.com/security/cve/CVE-2025-29917
suse.com/security/cve/CVE-2025-29918