Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63450: Suricata FTP can miss later commands after early RETR/STOR

CVE-2026-63450 · published 1 month ago

Summary

Versions of Suricata before 8.0.6 treat an early FTP RETR or STOR command as a fatal error, which stops the FTP parser for the rest of the connection. This means later FTP actions may not be inspected or logged, reducing detection capability. Upgrade Suricata to version 8.0.6 or later to restore full FTP monitoring.

What to do

Update debian suricata to version 1:8.0.6-1.
Update oisf suricata to version 8.0.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	oisf	suricata	< 8.0.6
Debian:13	debian	suricata	All versions
Debian:14	debian	suricata	< 1:8.0.6-1 Fix: upgrade to 1:8.0.6-1
Ubuntu:16.04:LTS	canonical	suricata	All versions

Original advisory text

Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.

References

https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 URL
https://redmine.openinfosecfoundation.org/issues/8659 URL
https://ubuntu.com/security/CVE-2026-63450 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-63450 Third Party Advisory
https://github.com/OISF/suricata/pull/15704 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63450... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63450 Vendor Advisory
https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr Vendor Advisory
https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18 Patch
https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc Patch
https://security-tracker.debian.org/tracker/CVE-2026-63450 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-755Improper Handling of Exceptional Conditions

Timeline

Published18 Sep 2026

Updated4 Nov 2026

First seen18 Sep 2026

Sources

CVE-2026-63450 · NVD

CVE-2026-63450 · OSV

GHSA-56wx-7hqh-wfgr · GHSA

UBUNTU-CVE-2026-63450 · OSV

DEBIAN-CVE-2026-63450 · OSV

CVE-2026-63450 · MITRE

Track software like this

Free during beta