CVE-2026-63448

Executive Summary

CVE-2026-63448 is a memory and CPU exhaustion vulnerability (CWE-400) in Suricata's SMB protocol parser affecting versions prior to 7.0.17 and 8.0.6. An unauthenticated remote attacker who can deliver one-directional SMB traffic — such as async-oneside flows or asymmetric network paths — can force the parser to retain force-completed transactions indefinitely, cause unbounded per-flow state growth, and trigger repeated cleanup scans that exhaust CPU and memory. The result is degradation or denial of service on the IDS/IPS/NSM sensor itself, potentially blinding network monitoring and prevention capabilities across the protected environment.

Technical Analysis

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. The vulnerability resides in its Rust-based SMB parser, located under rust/src/smb according to the NVD description.

The core mechanism is a resource-management flaw in transaction lifecycle handling. Suricata's SMB parser creates transaction objects to track SMB request/response pairs as they are parsed from the traffic stream. Under normal bidirectional traffic, these transactions are eventually completed and cleaned up. However, the flaw manifests in two coupled behaviors:

1. Force-completed transaction retention on one-sided flows. When Suricata observes payload in only one direction — explicitly including async-oneside flows — the parser can force-complete transactions. Cleanup of these force-completed transactions waits for inspection in the unseen direction, which never arrives on a truly one-directional flow. As a result, completed transactions are never released from the per-flow transaction list.

2. SMB_MAX_TX bound evasion and repeated scanning. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound. Because cleanup logic repeatedly scans the growing transaction list, each cleanup pass becomes progressively more expensive as the list grows. An attacker generating sustained one-directional SMB traffic therefore causes:

   • Unbounded growth of per-flow parser state (memory exhaustion), and
   • Repeated, increasingly costly cleanup scans consuming CPU.

The interaction of these two factors — unbounded list growth plus superlinear cleanup cost — converts what might otherwise be a minor leakage into a practical CPU and memory exhaustion vector. Memory exhaustion on the sensor can lead to process termination or OOM-killer invocation, while CPU exhaustion degrades inspection throughput and can cause packet drops, undermining the sensor's core detection and prevention function.

The attack surface is the SMB protocol parser itself. Any network path that causes Suricata to see SMB payload in only one direction is potentially exploitable, which substantially widens the practical attack surface beyond traditional client-server SMB interactions. Asymmetric routing, misconfigured SPAN/TAP deployments (where only one direction is mirrored), async-oneside flow configurations, and deliberately crafted one-way traffic all expose the flaw.

CVSS 3.1 scoring (5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects:

• Network exploitable (AV:N) with no privileges (PR:N) and no user interaction (UI:N).
• High attack complexity (AC:H), consistent with the requirement for specific network conditions (one-directional payload visibility) to trigger.
• No confidentiality or integrity impact; high availability impact (A:H), consistent with resource exhaustion leading to denial of service.

CWE-400 (Uncontrolled Resource Consumption) is the correct and sole mapping.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is known for CVE-2026-63448. The attack chain below is inferred strictly from the vulnerability class (resource exhaustion in a network protocol parser) and the behaviors described in the NVD text. No specific function names, endpoints, or payload structures are invented.

1) Reconnaissance / target identification. The attacker identifies a network position from which SMB traffic can be delivered to a Suricata-monitored segment such that the sensor sees payload in only one direction. This includes environments using asymmetric routing, one-sided SPAN/TAP mirrors, or async-oneside flow configurations. The target is the Suricata sensor itself, not the SMB endpoints — the attacker need not authenticate to any SMB service, since the parser processes observed traffic.

2) Triggering the resource-consumption flaw class. The attacker emits sustained SMB traffic that the sensor observes in only one direction. Because cleanup of force-completed transactions waits for inspection in the unseen direction, and because transaction creation can exceed the SMB_MAX_TX bound, the per-flow transaction list grows without bound. This is the resource-consumption trigger: uncontrolled growth of parser state caused by the absence of a completing reply in the monitored direction.

3) Delivery / traffic generation layer. At the vulnerability-class level, the delivery method is simply sustained one-directional SMB protocol traffic directed at (or observable by) the sensor. The attacker controls their own traffic generation; the flaw does not require malformed packets per the description — it requires the directional asymmetry. No specific packet construction details are provided by the source data and none are asserted here.

4) Post-exploitation impact. Successful exploitation produces CPU and memory exhaustion on the Suricata sensor. Consequences include degradation of inspection throughput, packet drops, potential sensor process crash or OOM termination. In IPS deployments this can cause fail-open or fail-closed behavior depending on configuration, potentially permitting other malicious traffic to traverse the segment unimpeded — a secondary effect where the DoS on the sensor weakens the defense posture of the monitored network. No code execution, data theft, or integrity impact is indicated.

Impact Assessment

The impact is availability-focused. CVSS subscores: Availability High (A:H); Confidentiality None (C:N); Integrity None (I:N). Scope is Unchanged (S:U) — the exploited component (the Suricata parser) and the impacted component (the Suricata sensor) are the same.

Business impact stems from the loss of network visibility and prevention:

• Monitoring blindness: CPU/memory exhaustion degrades or halts IDS/NSM inspection, meaning malicious traffic on the monitored segment may go undetected.
• Prevention bypass: In IPS mode, sensor failure may allow malicious traffic to pass. Depending on fail-open/fail-closed configuration, this can either enable adversary transit or disrupt legitimate business flows.
• Operational cost: Repeated OOM events, process restarts, alert noise, and potential sensor replacement/restart cycles increase operational overhead.
• Blast radius: Any network segment whose traffic is inspected by an affected Suricata instance, especially where one-directional SMB visibility is possible (asymmetric routing, one-sided mirror ports). The attacker does not require SMB credentials, widening the pool of potential adversaries.
• No data compromise: No exfiltration, authentication bypass, or data modification is associated with this CVE.

Overall severity is moderate (5.9) but contextually elevated in environments where Suricata is the sole or primary detection/prevention control, or where SMB traffic visibility is asymmetric.

Detection Guidance

Sigma Rule

title: Possible Suricata SMB Parser Resource Exhaustion (CVE-2026-63448)
id: 7c2e9f1a-3b4d-4e6a-9c1f-2026cve63448
status: experimental
description: Detects sustained one-directional SMB traffic patterns and Suricata process resource exhaustion indicators consistent with CVE-2026-63448.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63448
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_suricata:
    Image|endswith: '/suricata'
    CommandLine|contains: 'suricata'
  selection_oom:
    - Keywords|contains: 'Out of memory'
    - Keywords|contains: 'oom-kill'
  selection_process:
    Image|endswith: '/suricata'
  condition: selection_process and selection_oom
falsepositives:
  - Legitimate high-throughput traffic causing resource pressure
  - Non-malicious asymmetric routing misconfiguration
level: medium
tags:
  - attack.t1499
  - cve.2026-63448

YARA Rule

rule CVE_2026_63448_Suricata_SMB_Resource_Exhaustion
{
    meta:
        description = "Detects Suricata SMB parser transaction accumulation indicators related to CVE-2026-63448"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63448"
        date = "2026-01-01"
        cve = "CVE-2026-63448"

    strings:
        $smb1 = { FF 53 4D 42 }
        $smb2 = { FE 53 4D 42 }
        $max_tx = "SMB_MAX_TX" ascii
        $src_smb = "rust/src/smb" ascii

    condition:
        (uint32be(0) == 0x00000000 or true) and
        any of ($smb1, $smb2) and
        any of ($max_tx, $src_smb)
}

Suricata IDS Rule

alert tcp any any -> any 445 (msg:"CVE-2026-63448 Possible Suricata SMB Parser DoS - sustained one-directional SMB SMB2 traffic"; flow:to_server,established; content:"|FE 53 4D 42|"; depth:4; threshold: type both, track by_src, count 200, seconds 30; classtype:attempted-dos; reference:cve,2026-63448; sid:202663448; rev:1;)

Elastic Detection

process where process.name == "suricata" and
  (message contains "Out of memory" or
   message contains "oom" or
   message contains "SMB_MAX_TX" or
   message contains "transaction")

Splunk SPL Query

index=* (sourcetype=suricata OR sourcetype=suricata:eve)
| search (event_type=alert AND signature="*SMB*") OR (message="*oom-kill*" AND process="suricata*")
| stats count by src_ip, dest_ip, signature, _time
| where count > 100
| sort - count

Wazuh OSSEC Rule

<group name="suricata,cve-2026-63448,">
  <rule id="202663448" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">alert</field>
    <field name="alert.signature">.*SMB.*</field>
    <description>CVE-2026-63448: Possible Suricata SMB parser resource exhaustion / one-directional SMB DoS activity</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
  <rule id="202663449" level="12">
    <decoded_as>syslog</decoded_as>
    <match>suricata.*(oom-kill|Out of memory)</match>
    <description>CVE-2026-63448: Suricata process terminated or threatened by memory exhaustion</description>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 8.0.6 and 7.0.17, but this status is not yet corroborated by tracked patch sources; treat patching as the primary remediation while independently validating vendor releases.

1. Immediate mitigations

   • Restrict SMB (TCP/445, TCP/139, UDP/137-138) visibility to bidirectional capture paths. Review SPAN/TAP configurations and asynchronous routing to eliminate one-directional SMB flows reaching Suricata sensors.
   • Apply resource controls to the Suricata process: set cgroup memory limits, configure max-pending-packets and stream memory caps conservatively, and monitor for OOM events.
   • Reduce SMB parser exposure in high-risk segments by scoping SMB monitoring to only segments requiring it, or filter SMB traffic where the sensor is not intended to inspect it.
   • Configure fail-open versus fail-closed IPS behavior deliberately, understanding the tradeoff under sensor exhaustion.
   • Add alerting on Suricata RSS growth and OOM-killer events (see Detection Guidance).

2. Patch/upgrade steps

   • Upgrade Suricata to version 8.0.6 (8.x branch) or 7.0.17 (7.x branch) when these releases are available from the vendor and validated.
   • Verify the release notes/changelog explicitly reference the SMB transaction bound/cleanup fix before deploying.
   • Maintain staged rollout: validate on a mirror in a lab, monitor CPU/memory, then production.
   • After upgrade, confirm the SMB parser transaction bound (SMB_MAX_TX) and cleanup behavior are corrected in the running build.

3. Long-term hardening

   • Enforce bidirectional mirrored traffic for all IDS/IPS sensor placement as an architectural standard.
   • Deploy layered SMB inspection so a single sensor's failure does not eliminate all coverage.
   • Continuous track Suricata security advisories and subscribe to the project's release channels.
   • Baseline sensor resource consumption and alert on anomalous growth to catch similar unbounded-state flaws early.
   • Maintain a failover sensor pair so one instance's exhaustion does not create a single point of blind spot.

References

• NVD — CVE-2026-63448: https://nvd.nist.gov/vuln/detail/CVE-2026-63448
• Suricata project (OISF) release/advisory channel — verify 8.0.6 and 7.0.17 release notes referencing the SMB parser fix.
• CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• FIRST EPSS — CVE-2026-63448: not yet scored (no EPSS value available at time of writing).
• CISA KEV: not listed (as of report generation).

No public PoC, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat actor campaigns is currently associated with CVE-2026-63448 based on the data available. This is a newly disclosed parser-level denial-of-service condition; monitoring vendor channels for updated exploitation evidence is advised.