{"id":"CVE-2025-59148","aliases":["ALPINE-CVE-2025-59148","EUVD-2025-33225","GHSA-5qf6-92xg-3rr3","UBUNTU-CVE-2025-59148","openSUSE-SU-2025:15592-1"],"status":"published","title":"Suricata's improper use of entropy keyword can lead to a NULL-ptr deref","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00434,"percentile":0.3796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-10-01T00:00:00Z","modified":"2026-11-03T06:32:16Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"suricata","fixed_in":["8.0.1-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-r0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.8-1build1","2.0.9-1","2.0.10-1","2.0.10-2","2.0.11-1","3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0.4-2","1:6.0.4-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.0-2","1:7.0.2-1","1:7.0.2-1build1","1:7.0.3-1build1","1:7.0.3-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.8-2","1:7.0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0.3-1","1:8.0.5-1","1:8.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10-1","1:8.0.1-3build1","1:8.0.2-1","1:8.0.2-1build1","1:8.0.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"suricata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1.1"}]}],"bundled":4}],"products":[{"vendor":"oisf","product":"suricata"}],"references":[{"url":"https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3","tags":["x_refsource_CONFIRM","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://redmine.openinfosecfoundation.org/issues/7838","tags":["x_refsource_MISC","Issue Tracking","web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-59148","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59148.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59148","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-59148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59148","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59150","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-59148","title":"Suricata's improper use of entropy keyword can lead to a NULL-ptr deref","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T19:51:27.388Z","modified":"2025-10-01T19:58:13.158Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-33225","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T19:51:27Z","modified":"2025-10-01T19:58:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:37.123578Z"}],"nvd":[{"id":"CVE-2025-59148","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T20:18:38.48Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"ALPINE-CVE-2025-59148","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T20:18:38.48Z","modified":"2026-11-03T06:32:16.902179455Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2025-59148","title":"Suricata's improper use of entropy keyword can lead to a NULL-ptr deref","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T19:51:27.388Z","modified":"2026-10-28T10:45:42.699137192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"UBUNTU-CVE-2025-59148","description":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.","status":"published","published":"2025-10-01T20:18:00Z","modified":"2026-10-17T12:55:54.713631283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"openSUSE-SU-2025:15592-1","title":"libsuricata8_0_1-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the libsuricata8_0_1-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-03-23T04:53:58.737544Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}