CVE-2025-59148
Publication date 1 October 2025
Last updated 8 October 2025
Ubuntu priority
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| suricata | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial | Ignored end of ESM support, was needs-triage |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2025-59148
- https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3
- https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c (suricata-8.0.1)
- https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
- https://redmine.openinfosecfoundation.org/issues/7838
- https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c