CVE-2024-55629
Oisf Suricata ≤ 7.0.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2024-55629 is a high-severity Incomplete Model of Endpoint Features (CWE-437) vulnerability in Oisf Suricata. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Rootkit (T1014); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-55629 affects Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. In versions prior to 7.0.8, the vulnerability arises when processing TCP streams containing urgent data (also known as out-of-band data). This causes Suricata to analyze the data differently from the applications at the TCP endpoints, potentially leading to detection evasions. The issue is classified under CWE-437 (Incomplete Model Error) and CWE-436 (Interpretation Conflict), with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high integrity impact without confidentiality or availability disruption.
Remote attackers with network access can exploit this vulnerability without authentication or user interaction. By crafting TCP packets with the urgent flag and associated out-of-band data, adversaries can manipulate how Suricata interprets the stream, causing it to miss or incorrectly classify malicious payloads that endpoint applications process normally. This enables evasion of security rules, allowing attacks like command injection, data exfiltration, or other exploits to bypass Suricata's detection and prevention capabilities.
Mitigation is addressed in Suricata 7.0.8 through configurable handling of TCP urgent data, as detailed in the official GitHub security advisory (GHSA-69wr-vhwg-84h2) and related commits. Users should upgrade to version 7.0.8 or later. In IPS mode, a workaround involves deploying a drop rule such as "drop tcp any any -> any any (sid:1; tcp.flags:U*;) " to discard packets with the urgent flag set, preventing exploitation until patching is feasible. Additional details are available in the Open Information Security Foundation's Redmine issue tracker (issue 7411).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52827
Vulnerability Data
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the…
more
TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover cases where two products interpret the same inputs or state transitions differently.
Strict, consistently applied input validation reduces the chance that one product will accept data the other product rejects or interprets differently.
Requires explicit security architectures that describe component interactions and behaviors, directly reducing the chance of building an incomplete endpoint model.
Requires developers to produce designs that document security-relevant behaviors and state of system components including endpoints.
Mandates application of engineering principles such as complete mediation and accurate abstraction that structurally avoid incomplete endpoint models.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-437's incomplete endpoint model directly impairs a monitor's detection logic (mostly degrading DE.CM-01's adverse-event finding), while the same flaw removes most of the monitoring outcome's reliability across its scope.
Secure SDLC practices directly reduce the chance of introducing parser or state-machine inconsistencies.
Correlating logs from multiple products can surface discrepancies caused by interpretation conflicts.
Runtime monitoring of software behavior can detect adverse outcomes stemming from differing interpretations.
Supplier risk assessments can identify products whose differing interpretations create systemic exposure.
CWE-437 can cause monitoring/containment products to take incorrect actions due to an incomplete endpoint model, impairing (but not fully defeating) RS.MI-01's automatic or manual containment capability.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can validate that the intermediary correctly handles all documented and undocumented endpoint features.
Network security controls can enforce endpoint capability discovery and validation, reducing the risk of acting on an incomplete model.
Defining security requirements for network services can include explicit endpoint feature negotiation and state tracking.
A secure SDLC can mandate complete endpoint capability modeling during design and threat modeling phases.
Application security requirements can specify the need for exhaustive endpoint feature, behavior, and state modeling.
Secure architecture principles emphasize complete system modeling, including all endpoint capabilities and states.