CVE-2026-63450
Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
| CWE | CWE-755 |
| Vendor | oisf |
| Product | suricata |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for oisf suricata
Be the first to know when new low vulnerabilities affecting oisf suricata are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
OISF / suricata
< 8.0.6
References
github.com: https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr github.com: https://github.com/OISF/suricata/pull/15704 github.com: https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18 github.com: https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc github.com: https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 redmine.openinfosecfoundation.org: https://redmine.openinfosecfoundation.org/issues/8659