CVE-2025-59148
Suricata's improper use of entropy keyword can lead to a NULL-ptr deref
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Suricata's improper use of entropy keyword can lead to a NULL-ptr deref
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
CVE-2025-59148- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-33225
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
EUVD-2025-33225- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
CVE-2025-59148- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-59148
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
ALPINE-CVE-2025-59148- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Suricata's improper use of entropy keyword can lead to a NULL-ptr deref
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
CVE-2025-59148- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-59148
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
- Record
UBUNTU-CVE-2025-59148- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15592-1 No score
libsuricata8_0_1-8.0.1-1.1 on GA media
These are all security issues fixed in the libsuricata8_0_1-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15592-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
suricataAlpine:v3.24 |
before 8.0.1-r0 | 8.0.1-r0 |
suricataUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.8-1build12.0.9-12.0.10-12.0.10-22.0.11-13.0-1 |
None known |
suricataUbuntu:18.04:LTS |
All versions, plus listed versions 3.2-2ubuntu3 |
None known |
suricataUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0.4-21:6.0.4-3 |
None known |
suricataUbuntu:24.04:LTS |
All versions, plus listed versions 1:7.0.0-21:7.0.2-11:7.0.2-1build11:7.0.3-1build11:7.0.3-1build3 |
None known |
suricataUbuntu:25.10 |
All versions, plus listed versions 1:7.0.8-21:7.0.10-1 |
None known |
suricataUbuntu:26.10 |
All versions, plus listed versions 1:8.0.3-11:8.0.5-11:8.0.6-1 |
None known |
suricataUbuntu:26.04:LTS |
All versions, plus listed versions 1:7.0.10-11:8.0.1-3build11:8.0.2-11:8.0.2-1build11:8.0.3-1 |
None known |
suricataopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.0.1-1.1 | 8.0.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59148 is a high vulnerability (CVSS 7.5) in Oisf Suricata, published October 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in suricata 8.0.1-r0.
References
github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3
forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
redmine.openinfosecfoundation.org/issues/7838
security.alpinelinux.org/vuln/CVE-2025-59148