What’s Vulnerable › Vulnerabilities

CVE-2025-29915: Suricata af-packet: defrag option can lead to truncated packets affecting visibility

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-10 · updated 2026-06-17
• Weakness: CWE-347

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

Affected products

• OISF suricata: before 7.0.9 — fixed in 7.0.9

How to fix

Upgrade to a fixed version: OISF suricata 7.0.9. Check the vendor advisory for mitigations.

References

• https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d
• https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp
• https://redmine.openinfosecfoundation.org/issues/5373

Get alerted when CVE-2025-29915 or the next vulnerability affects your stack