Suricata Infinite Loop Vulnerability in PCRE Rule Processing

A vulnerability in Suricata's handling of PCRE (Perl Compatible Regular Expressions) rules can lead to an infinite loop, particularly when negated PCRE is used. This issue occurs in versions of Suricata prior to 7.0.9. The vulnerability arises because negated PCRE should only be evaluated once, unlike regular PCRE, which can assess multiple occurrences. When exploited, the packet processing thread becomes trapped in the loop, disrupting visibility and availability, especially in inline mode.

Impact

Exploitation of this vulnerability causes the packet processing thread to become stuck in an infinite loop, which limits visibility and availability in inline mode.

Remediation

Users are advised to upgrade to Suricata version 7.0.9 or later.