Suricata Large Memory Allocation Vulnerability in Base64 Decode Handling

A vulnerability exists in Suricata versions prior to 7.0.9, where the 'bytes' setting in the 'decode_base64' keyword is not properly restricted. This flaw can lead to excessive memory allocations of up to 4 GiB per thread, potentially causing resource starvation. The issue arises from untrusted signatures that can manipulate the base64 decoding process, allowing for large amounts of data to be processed and stored in memory.

Impact

Exploitation of this vulnerability can cause significant memory usage per thread, leading to resource exhaustion and potential denial of service.

Remediation

Users are advised to upgrade to Suricata version 7.0.9 or later.