Vulnerability-Lookup

CVE-2024-37151 (GCVE-0-2024-37151)

Vulnerability from cvelistv5 – Published: 2024-07-11 14:39 – Updated: 2025-11-03 19:30

Title

Suricata defrag: IP ID reuse can lead to policy bypass

Summary

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-11 15:59 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/OISF/suricata/security/advisor…	x_refsource_CONFIRM
https://github.com/OISF/suricata/commit/9d5c4273c…	x_refsource_MISC
https://github.com/OISF/suricata/commit/aab7f35c7…	x_refsource_MISC
https://redmine.openinfosecfoundation.org/issues/7041	x_refsource_MISC
https://redmine.openinfosecfoundation.org/issues/7042	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

3 products

Vendor	Product	Version	CPE status
OISF	suricata	Affected: >= 6.0.0, < 6.0.20 Affected: >= 7.0.0,< 7.0.6	guessed
oisf	suricata	Affected: 6.0.0 , < 6.0.20 (custom) cpe:2.3:a:oisf:suricata:6.0.0:-::::::
oisf	suricata	Affected: 7.0.0 , < 7.0.6 (custom) cpe:2.3:a:oisf:suricata:7.0.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oisf:suricata:6.0.0:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "suricata",
            "vendor": "oisf",
            "versions": [
              {
                "lessThan": "6.0.20",
                "status": "affected",
                "version": "6.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oisf:suricata:7.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "suricata",
            "vendor": "oisf",
            "versions": [
              {
                "lessThan": "7.0.6",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T15:59:30.704290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-12T15:51:20.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:30:13.398Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
          },
          {
            "name": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
          },
          {
            "name": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
          },
          {
            "name": "https://redmine.openinfosecfoundation.org/issues/7041",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7041"
          },
          {
            "name": "https://redmine.openinfosecfoundation.org/issues/7042",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7042"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "suricata",
          "vendor": "OISF",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0,\u003c 7.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-11T14:39:32.766Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
        },
        {
          "name": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
        },
        {
          "name": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
        },
        {
          "name": "https://redmine.openinfosecfoundation.org/issues/7041",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://redmine.openinfosecfoundation.org/issues/7041"
        },
        {
          "name": "https://redmine.openinfosecfoundation.org/issues/7042",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://redmine.openinfosecfoundation.org/issues/7042"
        }
      ],
      "source": {
        "advisory": "GHSA-qrp7-g66m-px24",
        "discovery": "UNKNOWN"
      },
      "title": "Suricata defrag: IP ID reuse can lead to policy bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-37151",
    "datePublished": "2024-07-11T14:39:32.766Z",
    "dateReserved": "2024-06-03T17:29:38.328Z",
    "dateUpdated": "2025-11-03T19:30:13.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-37151",
      "date": "2026-10-22",
      "epss": "0.00621",
      "percentile": "0.4909"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "suricata",
                "vendor": "OISF",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 6.0.0, \u003c 6.0.20"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0,\u003c 7.0.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:oisf:suricata:6.0.0:-:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "suricata",
                "vendor": "oisf",
                "versions": [
                  {
                    "lessThan": "6.0.20",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:oisf:suricata:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "suricata",
                "vendor": "oisf",
                "versions": [
                  {
                    "lessThan": "7.0.6",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C796A1DA-B8E9-45E4-BBCF-7673AB7DDC99",
                    "versionEndExcluding": "6.0.20",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "108D4F28-A795-4119-A750-9108C85201DC",
                    "versionEndExcluding": "7.0.6",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem."
          },
          {
            "lang": "es",
            "value": "Suricata es un sistema de detecci\u00f3n de intrusiones en la red, un sistema de prevenci\u00f3n de intrusiones y un motor de monitoreo de seguridad de la red. El mal manejo de varios paquetes fragmentados que utilizan el mismo valor de ID de IP puede provocar un error en el reensamblaje del paquete, lo que puede provocar una omisi\u00f3n de pol\u00edticas. Actualice a 7.0.6 o 6.0.20. Cuando utilice af-packet, habilite `defrag` para reducir el alcance del problema."
          }
        ],
        "id": "CVE-2024-37151",
        "lastModified": "2026-06-17T07:37:50.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-37151",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T15:59:30.704290Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-07-11T15:15:11.847",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7041"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7042"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7041"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://redmine.openinfosecfoundation.org/issues/7042"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-754"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-754"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-02-02T10:58:49+00:00",
      "cve": "CVE-2024-37151",
      "id": "CVE-2024-37151",
      "initial_release_date": "2024-07-11T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "suricata: packet reassembly failure, which can lead to policy bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-37151.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T19:30:13.398Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
              },
              {
                "name": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
              },
              {
                "name": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
              },
              {
                "name": "https://redmine.openinfosecfoundation.org/issues/7041",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://redmine.openinfosecfoundation.org/issues/7041"
              },
              {
                "name": "https://redmine.openinfosecfoundation.org/issues/7042",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://redmine.openinfosecfoundation.org/issues/7042"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:oisf:suricata:6.0.0:-:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "suricata",
                "vendor": "oisf",
                "versions": [
                  {
                    "lessThan": "6.0.20",
                    "status": "affected",
                    "version": "6.0.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:oisf:suricata:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "suricata",
                "vendor": "oisf",
                "versions": [
                  {
                    "lessThan": "7.0.6",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-37151",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-11T15:59:30.704290Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-11T16:04:03.011Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "suricata",
              "vendor": "OISF",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 6.0.0, \u003c 6.0.20"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0,\u003c 7.0.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-754",
                  "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-07-11T14:39:32.766Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
            },
            {
              "name": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
            },
            {
              "name": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
            },
            {
              "name": "https://redmine.openinfosecfoundation.org/issues/7041",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://redmine.openinfosecfoundation.org/issues/7041"
            },
            {
              "name": "https://redmine.openinfosecfoundation.org/issues/7042",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://redmine.openinfosecfoundation.org/issues/7042"
            }
          ],
          "source": {
            "advisory": "GHSA-qrp7-g66m-px24",
            "discovery": "UNKNOWN"
          },
          "title": "Suricata defrag: IP ID reuse can lead to policy bypass"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-37151",
        "datePublished": "2024-07-11T14:39:32.766Z",
        "dateReserved": "2024-06-03T17:29:38.328Z",
        "dateUpdated": "2025-11-03T19:30:13.398Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-37151

Vulnerability from fkie_nvd - Published: 2024-07-11 15:15 - Updated: 2026-06-17 07:37

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0	Patch
security-advisories@github.com	https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b	Patch
security-advisories@github.com	https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24	Vendor Advisory
security-advisories@github.com	https://redmine.openinfosecfoundation.org/issues/7041	Issue Tracking
security-advisories@github.com	https://redmine.openinfosecfoundation.org/issues/7042	Issue Tracking
af854a3a-2127-422b-91ae-364da2661108	https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html
af854a3a-2127-422b-91ae-364da2661108	https://redmine.openinfosecfoundation.org/issues/7041	Issue Tracking
af854a3a-2127-422b-91ae-364da2661108	https://redmine.openinfosecfoundation.org/issues/7042	Issue Tracking

Impacted products

	Vendor	Product	Version
	oisf	suricata	*
	oisf	suricata	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "suricata",
          "vendor": "OISF",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0,\u003c 7.0.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:oisf:suricata:6.0.0:-:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "suricata",
          "vendor": "oisf",
          "versions": [
            {
              "lessThan": "6.0.20",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oisf:suricata:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "suricata",
          "vendor": "oisf",
          "versions": [
            {
              "lessThan": "7.0.6",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C796A1DA-B8E9-45E4-BBCF-7673AB7DDC99",
              "versionEndExcluding": "6.0.20",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "108D4F28-A795-4119-A750-9108C85201DC",
              "versionEndExcluding": "7.0.6",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. \nMishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem."
    },
    {
      "lang": "es",
      "value": "Suricata es un sistema de detecci\u00f3n de intrusiones en la red, un sistema de prevenci\u00f3n de intrusiones y un motor de monitoreo de seguridad de la red. El mal manejo de varios paquetes fragmentados que utilizan el mismo valor de ID de IP puede provocar un error en el reensamblaje del paquete, lo que puede provocar una omisi\u00f3n de pol\u00edticas. Actualice a 7.0.6 o 6.0.20. Cuando utilice af-packet, habilite `defrag` para reducir el alcance del problema."
    }
  ],
  "id": "CVE-2024-37151",
  "lastModified": "2026-06-17T07:37:50.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37151",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-07-11T15:59:30.704290Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-07-11T15:15:11.847",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://redmine.openinfosecfoundation.org/issues/7041"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://redmine.openinfosecfoundation.org/issues/7042"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://redmine.openinfosecfoundation.org/issues/7041"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://redmine.openinfosecfoundation.org/issues/7042"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

OPENSUSE-SU-2025:15394-1

Vulnerability from csaf_opensuse - Published: 2025-07-28 00:00 - Updated: 2026-09-20 21:38

Summary

libsuricata8_0_0-8.0.0-1.1 on GA media

Severity

Moderate

Scope

30 vulnerabilities in this advisory, including CVE-2024-37151.

CVE-2024-37151

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Recommended: 12 products

Open the full advisory

UBUNTU-CVE-2024-37151 (CVE-2024-37151)

Vulnerability from osv_ubuntu – Published: 2024-07-11 15:15 – Updated: 2025-10-24 05:10 – Source website

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-37151	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-37151	REPORT
	https://github.com/OISF/suricata/security/advisor…	REPORT
	https://github.com/OISF/suricata/commit/9d5c4273c…	REPORT
	https://github.com/OISF/suricata/commit/aab7f35c7…	REPORT
	https://redmine.openinfosecfoundation.org/issues/7041	REPORT
	https://redmine.openinfosecfoundation.org/issues/7042	REPORT
	https://github.com/OISF/suricata/commit/9d5c4273c…	REPORT
	https://github.com/OISF/suricata/commit/aab7f35c7…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "suricata",
            "binary_version": "3.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "suricata",
        "purl": "pkg:deb/ubuntu/suricata@3.0-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.8-1build1",
        "2.0.9-1",
        "2.0.10-1",
        "2.0.10-2",
        "2.0.11-1",
        "3.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtp-0.5.23-1",
            "binary_version": "3.2-2ubuntu3"
          },
          {
            "binary_name": "suricata",
            "binary_version": "3.2-2ubuntu3"
          },
          {
            "binary_name": "suricata-hyperscan",
            "binary_version": "3.2-2ubuntu3"
          },
          {
            "binary_name": "suricata-oinkmaster",
            "binary_version": "3.2-2ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "suricata",
        "purl": "pkg:deb/ubuntu/suricata@3.2-2ubuntu3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2-2ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "suricata",
            "binary_version": "1:6.0.4-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "suricata",
        "purl": "pkg:deb/ubuntu/suricata@1:6.0.4-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:6.0.4-2",
        "1:6.0.4-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "suricata",
            "binary_version": "1:7.0.3-1build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "suricata",
        "purl": "pkg:deb/ubuntu/suricata@1:7.0.3-1build3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:7.0.0-2",
        "1:7.0.2-1",
        "1:7.0.2-1build1",
        "1:7.0.3-1build1",
        "1:7.0.3-1build3"
      ]
    }
  ],
  "aliases": [],
  "details": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.",
  "id": "UBUNTU-CVE-2024-37151",
  "modified": "2025-10-24T05:10:13Z",
  "published": "2024-07-11T15:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-37151"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37151"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-qrp7-g66m-px24"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
    },
    {
      "type": "REPORT",
      "url": "https://redmine.openinfosecfoundation.org/issues/7041"
    },
    {
      "type": "REPORT",
      "url": "https://redmine.openinfosecfoundation.org/issues/7042"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OISF/suricata/commit/9d5c4273cb7e5ca65f195f7361f0d848c85180e0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OISF/suricata/commit/aab7f35c76721df19403a7c0c0025feae12f3b6b"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-37151"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-37151 (GCVE-0-2024-37151)

FKIE_CVE-2024-37151

OPENSUSE-SU-2025:15394-1

UBUNTU-CVE-2024-37151 (CVE-2024-37151)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour