PatchTheCVECVE-2017-15377: In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network
CVE-2017-15377 is a high-severity flaw (CVSS 7.5) affecting suricata. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.0% (top 20%) |
| CISA exploited list | No |
| Published | 2017-10-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-15377?
suricata: upgrade to newer than 3.2.4. Exact commands for each OS are on this page.
Is CVE-2017-15377 being exploited?
CVE-2017-15377 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-15377 affect?
CVE-2017-15377 affects suricata. Severity is high (CVSS 7.5). In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engin
How urgent is CVE-2017-15377?
Priority 51/100. High severity; Remotely exploitable, no login, no user action
Software pages
Suricata and Snort vulnerabilities
Related CVEs
- CVE-2026-31937 HIGH 7.5 UPGRADE Suricata is a network IDS, IPS and NSM engine
- CVE-2026-31931 HIGH 7.5 UPGRADE Suricata is a network IDS, IPS and NSM engine
- CVE-2026-31933 HIGH 7.5 UPGRADE Suricata is a network IDS, IPS and NSM engine
- CVE-2026-31932 HIGH 7.5 UPGRADE Suricata is a network IDS, IPS and NSM engine
- CVE-2026-31934 HIGH 7.5 UPGRADE Suricata is a network IDS, IPS and NSM engine