What’s Vulnerable › Vulnerabilities

CVE-2025-64335: Suricata is vulnerable to a null deref when used with base64_data

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-26 · updated 2026-10-18
• Weakness: CWE-476

Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.

Affected products

• OISF suricata: from 8.0.0 before 8.0.2 — fixed in 8.0.2

How to fix

Upgrade to a fixed version: OISF suricata 8.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/OISF/suricata/commit/c935f08cd988600fd0a4f828a585b181dd5de012
• https://github.com/OISF/suricata/security/advisories/GHSA-v299-h7p3-q4f2
• https://www.vicarius.io/vsociety/posts/cve-2025-64335-detect-suricata-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-64335-mitigate-suricata-vulnerability

Get alerted when CVE-2025-64335 or the next vulnerability affects your stack