CVE-2016-10728

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-23 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.

Affected products

Suricata-Ids Suricata: before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: Suricata-Ids Suricata 3.1.2. Check the vendor advisory for mitigations.

References

https://github.com/kirillwow/ids_bypass
https://lists.debian.org/debian-lts-announce/2018/09/msg00019.html
https://redmine.openinfosecfoundation.org/issues/1880
https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/
https://github.com/kirillwow/ids_bypass
https://lists.debian.org/debian-lts-announce/2018/09/msg00019.html
https://redmine.openinfosecfoundation.org/issues/1880
https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/

Get alerted when CVE-2016-10728 or the next vulnerability affects your stack