{"id":"CVE-2024-37151","aliases":["ALPINE-CVE-2024-37151","DEBIAN-CVE-2024-37151","DLA-4103-1","EUVD-2024-36467","GHSA-qrp7-g66m-px24","MGASA-2024-0306","UBUNTU-CVE-2024-37151","openSUSE-SU-2025:15394-1"],"status":"published","title":"Suricata defrag: IP ID reuse can lead to policy bypass","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00621,"percentile":0.5005,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2024-07-11T14:39:32Z","modified":"2026-11-03T06:32:07Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"suricata","fixed_in":["7.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"suricata","fixed_in":["7.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"suricata","fixed_in":["7.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"suricata","fixed_in":["7.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"suricata","fixed_in":["7.0.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"suricata","fixed_in":["1:7.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"suricata","fixed_in":["1:7.0.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-3+deb11u1"}]}],"versions":["1:6.0.1-3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.20-1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.8-1build1","2.0.9-1","2.0.10-1","2.0.10-2","2.0.11-1","3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0.4-2","1:6.0.4-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.0-2","1:7.0.2-1","1:7.0.2-1build1","1:7.0.3-1build1","1:7.0.3-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1.1"}]}],"bundled":30}],"products":[{"vendor":"oisf","product":"suricata"}],"references":[{"url":"https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://redmine.openinfosecfoundation.org/issues/7041","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web","report"]},{"url":"https://redmine.openinfosecfoundation.org/issues/7042","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-37151","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37151.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37151","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-37151","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0306.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33431","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JJWELU75TPOICUA2UGNZDY7QQJBB7HYJ/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-37151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37151","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29918","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-37151","title":"Suricata defrag: IP ID reuse can lead to policy bypass","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T14:39:32.766Z","modified":"2025-11-03T19:30:13.398Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-36467","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T14:39:32Z","modified":"2025-11-03T19:30:13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"nvd":[{"id":"CVE-2024-37151","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T15:15:11.847Z","modified":"2026-06-17T07:37:50.997Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:10:12.016585Z"}],"osv":[{"id":"ALPINE-CVE-2024-37151","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T15:15:11.847Z","modified":"2026-11-03T06:32:07.198602858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2024-37151","title":"Suricata defrag: IP ID reuse can lead to policy bypass","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T14:39:32.766Z","modified":"2026-10-28T10:44:06.674446419Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"DEBIAN-CVE-2024-37151","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.  Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T15:15:11.847Z","modified":"2026-11-02T12:02:35.550429437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"UBUNTU-CVE-2024-37151","description":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.","status":"published","published":"2024-07-11T15:15:00Z","modified":"2025-10-24T05:10:13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"DLA-4103-1","title":"suricata - security update","status":"published","published":"2025-03-31T00:00:00Z","modified":"2026-03-09T01:18:14.108597Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0306","title":"Updated suricata packages fix security vulnerabilities","description":"CVE-2024-37151 Mishandling of multiple fragmented packets using the same\nIP ID value can lead to packet reassembly failure, which can lead to\npolicy bypass.\nCVE-2024-38534 Crafted modbus traffic can lead to unlimited resource\naccumulation within a flow\nCVE-2024-38535, CVE-2024-38536 Suricata can run out of memory when\nparsing crafted HTTP/2 traffic.\n","status":"published","published":"2024-09-17T02:41:21Z","modified":"2026-04-16T04:42:22.489920391Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:15394-1","title":"libsuricata8_0_0-8.0.0-1.1 on GA media","description":"These are all security issues fixed in the libsuricata8_0_0-8.0.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-28T00:00:00Z","modified":"2026-03-23T04:53:43.337191Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}