{"id":"CVE-2018-6794","aliases":["DEBIAN-CVE-2018-6794","DLA-1603-1","EUVD-2018-18541","GHSA-wfvj-pf5x-3547","UBUNTU-CVE-2018-6794"],"status":"published","title":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream...","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.23687,"percentile":0.97829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-693"],"published":"2018-02-07T05:00:00Z","modified":"2026-10-24T10:47:45Z","exploits":[{"source":"exploitdb","id":"EDB-44247","title":"Suricata \u003c 4.0.4 - IDS Detection Bypass","type":"dos","platform":"multiple","date":"2018-03-05","url":"https://www.exploit-db.com/exploits/44247"}],"fixes":[{"ecosystem":"Debian:13","package":"suricata","fixed_in":["1:4.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"suricata","fixed_in":["1:4.0.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2+deb8u3"}]}],"versions":["2.0.7-2","2.0.7-2+deb8u1","2.0.7-2+deb8u2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.8-1build1","2.0.9-1","2.0.10-1","2.0.10-2","2.0.11-1","3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2-2ubuntu3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"suricata-ids","product":"suricata"}],"references":[{"url":"https://github.com/OISF/suricata/pull/3202/commits/e1ef57c848bbe4e567d5d4b66d346a742e3f77a1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://redmine.openinfosecfoundation.org/issues/2427","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://suricata-ids.org/2018/02/14/suricata-4-0-4-available/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/44247/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6794"},{"url":"https://github.com/advisories/GHSA-wfvj-pf5x-3547"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6794","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6794","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6794","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-6794","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:00:00Z","modified":"2024-08-05T06:10:11.364Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18541","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:00:00Z","modified":"2024-08-05T06:10:11Z","updated_at":"2026-11-03T02:40:07.110514Z"}],"ghsa":[{"id":"GHSA-wfvj-pf5x-3547","title":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream...","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2022-05-14T01:29:42Z","modified":"2023-02-02T05:03:56Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:51:45.334217Z"}],"nvd":[{"id":"CVE-2018-6794","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:29:00.26Z","modified":"2026-06-17T02:02:17.767Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-6794","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:29:00.26Z","modified":"2026-10-24T10:47:45.562060919Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6794","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:29:00.26Z","modified":"2026-10-23T18:03:48.072329806Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-6794","description":"Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.","status":"published","published":"2018-02-07T05:29:00Z","modified":"2025-10-24T04:46:55Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-1603-1","title":"suricata - security update","status":"published","published":"2018-12-04T00:00:00Z","modified":"2026-03-09T01:20:13.459195Z","updated_at":"2026-11-02T15:46:09.777694Z"}]}}