CVE-2025-59147: oisf suricata
Vulnerability summary
CVE-2025-59147 is a high (CVSS 7.5) vulnerability in oisf suricata. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 01-10-2025PublishedVulnerability first disclosed.
- 01-10-2025Last modifiedVulnerability information updated.
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.37% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- suricata< 1:7.0.10-1+deb13u1 | < 1:8.0.1-1
Oisf1 product
- suricata≥ 8.0.0, < 8.0.1 | < 7.0.12 | 8.0.0 | 8.0.0:beta1 | 8.0.0:rc1
Ubuntu1 product
- suricataAll versions (No fix recorded)
3 vendors · 3 products
References
7 links- github.com/OISF/suricata/security/advisories/GHSA-v8hv-6v7x-4c2rX Refsource CONFIRMREPORTIssue TrackingThird Party Advisory
