{"id":"CVE-2024-55629","summary":"Suricata generic detection bypass using TCP urgent support","details":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -\u003e any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.","aliases":["GHSA-69wr-vhwg-84h2"],"modified":"2026-08-12T15:16:07.948984Z","published":"2025-01-06T18:04:08.180Z","related":["openSUSE-SU-2025:15394-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-437"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55629.json"},"references":[{"type":"WEB","url":"https://redmine.openinfosecfoundation.org/issues/7411"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55629.json"},{"type":"ADVISORY","url":"https://github.com/OISF/suricata/security/advisories/GHSA-69wr-vhwg-84h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55629"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/suricata","events":[{"introduced":"0"},{"fixed":"97e69ffb1bc2b7358115ee59f460a924893664e8"},{"fixed":"6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7"},{"fixed":"779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8"}],"database_specific":{"cpe":"cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.0.8"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["suricata-7.0.7","suricata-7.0.6","suricata-7.0.5","suricata-7.0.4","suricata-7.0.3","suricata-7.0.2","suricata-7.0.1","suricata-7.0.0","suricata-7.0.0-rc2","suricata-7.0.0-rc1","suricata-7.0.0-beta1","suricata-6.0.1","suricata-6.0.0","suricata-6.0.0-rc1","suricata-6.0.0-beta1","suricata-5.0.1","suricata-5.0.0","suricata-5.0.0-rc1","suricata-5.0.0-beta1","suricata-4.1.2","suricata-4.1.1","suricata-4.1.0","suricata-4.1.0-rc2","suricata-4.1.0-rc1","suricata-4.1.0-beta1","suricata-4.0.1","suricata-4.0.0","suricata-4.0.0-rc2","suricata-4.0.0-rc1","suricata-4.0.0-beta1","suricata-3.2.1","suricata-3.2","suricata-3.2RC1","suricata-3.2beta1","suricata-3.1.2","suricata-3.1.1","suricata-3.1","suricata-3.0.1","suricata-3.1RC1","suricata-3.0.1RC1","suricata-3.0","suricata-3.0RC3","suricata-3.0RC2","suricata-3.0RC1","suricata-2.1beta4","suricata-2.1beta3","suricata-2.1beta2","suricata-2.1beta1","suricata-2.0.2","suricata-2.0.1","suricata-2.0.1rc1","suricata-2.0","suricata-2.0rc3","suricata-2.0rc2","suricata-2.0rc1","suricata-2.0beta2","suricata-2.0beta1","suricata-1.4","suricata-1.4rc1","suricata-1.4beta3","suricata-1.4beta2","suricata-1.4beta1","suricata-1.3.1","suricata-1.3","suricata-1.3rc1","suricata-1.3beta2","suricata-1.3beta1","suricata-1.2.1","suricata-1.2","suricata-1.2rc1","suricata-1.2beta1","suricata-1.1","suricata-1.1rc1","suricata-1.1beta3","suricata-1.1beta2","suricata-1.1beta1","suricata-1.0.2","suricata-1.0.1","suricata-1.0.0","suricata-0.8.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55629.json","vanir_signatures_modified":"2026-08-12T15:16:07Z","vanir_signatures":[{"id":"CVE-2024-55629-01c3adce","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/app-layer.c","function":"AppLayerHandleTCPData"},"deprecated":false,"digest":{"function_hash":"185380009157651331036026021221488117506","length":3964}},{"deprecated":false,"digest":{"line_hashes":["92214950941896570439640459366496113704","127628494559559924243711447747223322482","85824320230842951166543807619381250917","26008685323319232262506969530542185746","42058918583787599372429573987891224780","67128099059319289876095601963993283149","327244826093433889685453949182099281375"],"threshold":0.9},"id":"CVE-2024-55629-0271bef3","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp.h"}},{"source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/app-layer.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["93988070030044538652672731785636094941","66688374469500014812789895497373883865","26041506071092839872680305072748044146","6614033688378769675539697755865551076"]},"id":"CVE-2024-55629-103c09a1","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/decode.h"},"deprecated":false,"digest":{"line_hashes":["157370462675009297242277780797555105637","290083996388997526002631238670659292798","340008159719511893226890593621386091688","291200064694562199064164824685631474958"],"threshold":0.9},"id":"CVE-2024-55629-17ee885c"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8","target":{"file":"src/output-json-flow.c","function":"EveFlowLogJSON"},"deprecated":false,"digest":{"function_hash":"180436151307496918903353144551779249773","length":2917},"id":"CVE-2024-55629-21c5ef67","signature_type":"Function"},{"target":{"file":"src/stream-tcp.c","function":"StreamTcpThreadInit"},"deprecated":false,"digest":{"function_hash":"98147826853052119554642867230654818802","length":3850},"id":"CVE-2024-55629-299a2fe1","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7"},{"source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/decode.c","function":"PacketDropReasonToJsonString"},"deprecated":false,"digest":{"length":1323,"function_hash":"253868420669810702106136075477125449279"},"id":"CVE-2024-55629-453c9897","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/decode-events.c"},"deprecated":false,"digest":{"line_hashes":["128919036592863813319320973137635391902","137567114943575858837347336148847364797","78344651208378031974258130842136740658","254946139288074140608795903593707546658"],"threshold":0.9},"id":"CVE-2024-55629-529f6d7e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp.c","function":"StreamTcpPacket"},"deprecated":false,"digest":{"function_hash":"316687656923229905309184965634296698150","length":3921},"id":"CVE-2024-55629-54c50ffb"},{"id":"CVE-2024-55629-6bd3e1cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/decode-events.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["42658419243292762069681274186037492603","61701140479430823424272242124716525429","70543255853730138972630499180970358251","212679646054171320220610463470973530181"]}},{"target":{"function":"PacketDropReasonToString","file":"src/decode.c"},"deprecated":false,"digest":{"function_hash":"240742013513858032262507527878513654556","length":1076},"id":"CVE-2024-55629-717ee57e","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/decode.c"},"deprecated":false,"digest":{"line_hashes":["41457942018887009980289847235853751367","320730400950753636196947384670467298115","22524271568291347782880133368204736143","271576154768376858182840650358393414876","132372530033583361643301355384604210842","304950908950488548128609900013933341898","206851473304415853888408614968504674999","217858627081367193982775976324844588609"],"threshold":0.9},"id":"CVE-2024-55629-733c8c69","signature_type":"Line"},{"source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp.c","function":"StreamTcpInitConfig"},"deprecated":false,"digest":{"function_hash":"111151771521282382582597766798700716759","length":8907},"id":"CVE-2024-55629-8ffb6a63","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["247444197301067839150843936456693838667","124987192403565723285106921671570779335","258107478565466856313496762363538501143","184886699053405966948566999439247228971"],"threshold":0.9},"id":"CVE-2024-55629-932a1d74","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8","target":{"file":"src/output-json-flow.c"},"deprecated":false},{"id":"CVE-2024-55629-96abf50c","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp-reassemble.c"},"deprecated":false,"digest":{"line_hashes":["330739789377564285941073832646313840289","166514749187064022849387324395412305400","243656613753037869613716110183778957324","238788686004278409331449004054797222002","296304369607211602627224446136140129154","144185312641026374779685724199963808613","339810861885796507603174726837878080096","298975711417809627301810642927880605178","246219331921174337248479310198566947929","249986552039211447013762162067955731272","282529606469854442704139196046037829555","266295112617426436101172996875998700322","3941499193078318595788748994536046324","187911621779901074642940802663084402760","68814877857775007697641906795002641103","23931961753872240620238998401623796126","331118802201698331309290728572839656151","125826486916478425282159515302402265444","20994706898300023297580833348097871871","104378448004376547868690757047305666704","89367014768543432119780486342481131654","132033676691934895332926925187027860053","5349428971963047341029381625293244994","154620265279206050663763915855781598400","222093834297790498902447906060059076021","214634257431915560623794850669010737258","144266663067691645411406866952235050945","24797102519031623003004767783615672188","37067561336232573019618005440435462488","159996713876155998412801218833119306971","34759768286217732850301683421267833691","108945728095410687153275691921844931686","339604421595876950602554167563257967098","131142339900289290225423354201741376933","90613912209011690744038006199355524645","243051516454475673609442601588728610694","277026082838446539757048230201563790536","214591283475709756615114760603806236729","339680537428815477114413875353596988302","203539537231332828750823277958505610322","301530589335956322839265521364537491059"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["103122315893570087025721973247816014476","332433639958119249682959599702566564582","35202765465456984170181903887028679470","67856461608324446553580199592455908715","14083723040887980789328244591913105471"],"threshold":0.9},"id":"CVE-2024-55629-96d15a8e","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp-list.c"}},{"id":"CVE-2024-55629-a57859f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp.c"},"deprecated":false,"digest":{"line_hashes":["306513867797521748548929076561112974860","137905995691024624895590927377319450","325542798445229904618953823994262484711","266689840707932945785500013221015532278","320530988787629077600088574561887644915","22735462308409039702577979840180902574","290647844188913140120457021160947782420","4464904341804486702681746984882139965","216452496083815948704603584069324418219","175223606862600225726175645881513736714","301746626118810644684546624374362949828","238549636946711477581502582701725735210","279179468224868742931296738472058329142","11491671291680237553084004894063455791","250203805136530143501047807148995438186","84250407339139722130540033818126393104"],"threshold":0.9}},{"id":"CVE-2024-55629-c3f049bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp-reassemble.c","function":"StreamTcpReassembleHandleSegmentHandleData"},"deprecated":false,"digest":{"length":2140,"function_hash":"334314412570527619205962071695496224569"}},{"source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp-reassemble.h"},"deprecated":false,"digest":{"line_hashes":["65736855430056808278063796980158629816","172613171482812679850478687785732469052","150186693316577884183527251046710665211","196567535154490924712594984329425190825"],"threshold":0.9},"id":"CVE-2024-55629-c488c8c7","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["39713888733385990030552413513584716262","79827034211631950698122057973649474526","110043784975631412858539805669961668613","226108511675793377784870897321243709600"],"threshold":0.9},"id":"CVE-2024-55629-f8ecae79","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7","target":{"file":"src/stream-tcp-private.h"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}