{"id":"CVE-2025-59147","summary":"Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets","details":"Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.","aliases":["GHSA-v8hv-6v7x-4c2r"],"modified":"2026-08-12T15:14:11.921261Z","published":"2025-10-01T19:27:55.639Z","related":["openSUSE-SU-2025:15592-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-358"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59147.json"},"references":[{"type":"WEB","url":"https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59147.json"},{"type":"ADVISORY","url":"https://github.com/OISF/suricata/security/advisories/GHSA-v8hv-6v7x-4c2r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59147"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/suricata","events":[{"introduced":"0"},{"fixed":"f305213aa267d7619d28d8ebb73d0e66dc5fe180"},{"introduced":"9956286fb89f9cad9e9f95b99dc751f8666617b7"},{"fixed":"be6315dba0d9101b11d16e9dacfe2822b3792f1b"},{"fixed":"e91b03c90385db15e21cf1a0e85b921bf92b039e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"7.0.12"},{"introduced":"8.0.0-NA"},{"last_affected":"8.0.0-NA"},{"introduced":"8.0.0-beta1"},{"last_affected":"8.0.0-beta1"},{"introduced":"8.0.0-rc1"},{"last_affected":"8.0.0-rc1"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*","cpe:2.3:a:oisf:suricata:8.0.0:-:*:*:*:*:*:*","cpe:2.3:a:oisf:suricata:8.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:oisf:suricata:8.0.0:rc1:*:*:*:*:*:*"]}}],"versions":["8.0.0-NA","8.0.0-beta1","8.0.0-rc1","suricata-8.0.0","suricata-7.0.11","suricata-7.0.10","suricata-7.0.9","suricata-7.0.8","suricata-7.0.7","suricata-7.0.6","suricata-7.0.5","suricata-7.0.4","suricata-7.0.3","suricata-7.0.2","suricata-7.0.1","suricata-7.0.0","suricata-7.0.0-rc2","suricata-7.0.0-rc1","suricata-7.0.0-beta1","suricata-6.0.1","suricata-6.0.0","suricata-6.0.0-rc1","suricata-6.0.0-beta1","suricata-5.0.1","suricata-5.0.0","suricata-5.0.0-rc1","suricata-5.0.0-beta1","suricata-4.1.2","suricata-4.1.1","suricata-4.1.0","suricata-4.1.0-rc2","suricata-4.1.0-rc1","suricata-4.1.0-beta1","suricata-4.0.1","suricata-4.0.0","suricata-4.0.0-rc2","suricata-4.0.0-rc1","suricata-4.0.0-beta1","suricata-3.2.1","suricata-3.2","suricata-3.2RC1","suricata-3.2beta1","suricata-3.1.2","suricata-3.1.1","suricata-3.1","suricata-3.0.1","suricata-3.1RC1","suricata-3.0.1RC1","suricata-3.0","suricata-3.0RC3","suricata-3.0RC2","suricata-3.0RC1","suricata-2.1beta4","suricata-2.1beta3","suricata-2.1beta2","suricata-2.1beta1","suricata-2.0.2","suricata-2.0.1","suricata-2.0.1rc1","suricata-2.0","suricata-2.0rc3","suricata-2.0rc2","suricata-2.0rc1","suricata-2.0beta2","suricata-2.0beta1","suricata-1.4","suricata-1.4rc1","suricata-1.4beta3","suricata-1.4beta2","suricata-1.4beta1","suricata-1.3.1","suricata-1.3","suricata-1.3rc1","suricata-1.3beta2","suricata-1.3beta1","suricata-1.2.1","suricata-1.2","suricata-1.2rc1","suricata-1.2beta1","suricata-1.1","suricata-1.1rc1","suricata-1.1beta3","suricata-1.1beta2","suricata-1.1beta1","suricata-1.0.2","suricata-1.0.1","suricata-1.0.0","suricata-0.8.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59147.json","vanir_signatures_modified":"2026-08-12T15:14:11Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"StreamTcp3whsFindSyn"},"deprecated":false,"digest":{"function_hash":"168275473544993175374273676830041469694","length":682},"id":"CVE-2025-59147-01d63599"},{"source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"TcpStateQueueInitFromSsnSyn"},"deprecated":false,"digest":{"length":900,"function_hash":"219276493880709262373854809105674879765"},"id":"CVE-2025-59147-25a3b125","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/stream-tcp.c","function":"StreamTcp3whsStoreSyn"},"deprecated":false,"digest":{"length":817,"function_hash":"267325000760323393911512943999966758902"},"id":"CVE-2025-59147-3bc5499f","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b"},{"digest":{"function_hash":"219276493880709262373854809105674879765","length":900},"id":"CVE-2025-59147-4084c4b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"file":"src/stream-tcp.c","function":"TcpStateQueueInitFromSsnSyn"},"deprecated":false},{"digest":{"function_hash":"175897116486016775792850450411611982595","length":806},"id":"CVE-2025-59147-41842624","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"StreamTcp3whsStoreSynApplyToSsn"},"deprecated":false},{"target":{"file":"src/stream-tcp.c","function":"StreamTcpPacketStateSynSent"},"deprecated":false,"digest":{"length":11144,"function_hash":"33304688430021522604734126960979736981"},"id":"CVE-2025-59147-60501e97","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b"},{"id":"CVE-2025-59147-62cf1844","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"TcpStateQueueInitFromPktSynAck"},"deprecated":false,"digest":{"function_hash":"102401700514992643890924322655025576361","length":854}},{"deprecated":false,"digest":{"line_hashes":["66824967794916701518952138692913701460","40338413859926506947874560061424797714","34376090247465565701273558644621405830","286730133613498799552808064249126430048","7693390102593260505411595998529611434","291050187761189196805909131614575836894","108109679452606703495564998961958657060","286730133613498799552808064249126430048","7693390102593260505411595998529611434","291050187761189196805909131614575836894","139077466010768457669102664408599847596","194499105961421823657487751413337320892","204161134951798934810387354364631099163","223821417830448212039471960667645711940","96061646228493967933743881295113944803","158138816801430100227923045220066274706","172335261322976612414996337317265314415","284930258187026851685744393771718598710","84897957719793763378787010771828216269","18345001897566117917453675981579903891","310615547299207451880067539599874680910","18260596158844744111567488787920303588","250668510250923319230897321365068606907","220884027888050459794073188008898298494","9155835743574194240451287805104643473","115765600512490140712093755722920212947","309137123707191894278201440707518561543","214247774765079579737470656476303401454","339075001706789294331542645720530159169","84587351606367527360834418902354493440","199180319962527981817044378409616228139","24981488014315268602782654406832267628","332905461496713582164535589763867744029","190987627303244527594504637996469584688","284978841136212485963750519597129388894","316049636762019681385812218658946241873","320753731992898367532777951024134678848","64297596093582670781544638716951688011","20844625784302354356675616870728844172","308885963931199585901406111857095420936","175603607796103174214748304054650793686","218020514103498334346461754264308257504","318365589609690343892411004041713443812","293666709672950281115090300515512042926","327461355754951232534274694429674468899","111190431246669682603636693337021014635","332048581456276706005029451092522050953","113923039043158979338357089233559549329","169507163137597325519550948991947934253","174980757291887815916816541475917590716","158112034835608567174141389491886886998","135234519294570329844894377624858604404","202123626781154072129535573889185328837","155684255847314184217235637794612368999","133438281615573302515426769888314718112","170904970647368644610366587208703192391","148160629417074073813278009966818040388","24844433388859826171032420372973141359","181583096190774522733638025919576613344","274677829308004335417879700582307884924","322284747134841513139214849938547535506","324093430553778562564694754904069789445","239539937371960333815533099889228872819","99221715182185763373918746661677068507","218540599771151189293988752177424184824","181218307148563483009031649380700731052","97234251370937748965449985463141761673","164707411708011609336844718719944524627","178648971782450014751896141016131053428","241026367816041896264044128727639044875","147007442248353363778887076328919926387","2361395940815347845554040484938788741","306249180748136311874151776642720230666","216717224642633968021846758779038625341","47219743752166501801525983752774577050","183582570455913848728592332395122051833","88317664812453855502868955222712106754","204215240036393422506616934802227434994","129597914760737217038321954575679231810","104917760585666877630149154507523132241","7046738916798274381296027664021074344","298796290967899776127296667242173908867","221203912202447604357786860986577166729","169405804969294408139754470145867460230","109623748887006051927461013669934390578","135608866728650664417430765896856361793","110098117075134408239104951431792248895","258998604720398680898870666869094178377","210232646366101892464281567198820429049","109666253106412792457704375484377913986","212193108993360547024474288443601361670","84455473685555146888451789769529027632","149033630399585440599543749099853564727","37425645629839673963993391651509255126","42427120086193091714233433936689471296","312736922824794935872700229865274404083","13878688442893199014972521896157788613","60334011953119813167598596462987489751","110006463270753763661026906248930674997","225125281590295285149941657688350032402","53418119095185916646857243700509814915","246925655395008488356796588233668588791","106150167108981686407894261368750217031","91346055117603869570645415941475670837","43065110316164149711327292041538038432"],"threshold":0.9},"id":"CVE-2025-59147-72c9b6c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"file":"src/stream-tcp.c"}},{"deprecated":false,"digest":{"function_hash":"102401700514992643890924322655025576361","length":854},"id":"CVE-2025-59147-771d4b6a","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"function":"TcpStateQueueInitFromPktSyn","file":"src/stream-tcp.c"}},{"deprecated":false,"digest":{"function_hash":"267325000760323393911512943999966758902","length":817},"id":"CVE-2025-59147-772455a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"StreamTcp3whsStoreSyn"}},{"source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"file":"src/stream-tcp.c","function":"StreamTcp3whsFindSyn"},"deprecated":false,"digest":{"function_hash":"168275473544993175374273676830041469694","length":682},"id":"CVE-2025-59147-84a18819","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-59147-a710d34a","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c"},"deprecated":false,"digest":{"line_hashes":["212787216895901603761410035898374223385","30440998942066520394698356262280067253","34376090247465565701273558644621405830","105609928556543537255904586333405943731","143165081660001920293338898463154387486","201818123367172816507312106934906505023","181223404083155871533619247335338607171","212186125726450321028913057192923150891","105609928556543537255904586333405943731","143165081660001920293338898463154387486","201818123367172816507312106934906505023","139077466010768457669102664408599847596","194499105961421823657487751413337320892","204161134951798934810387354364631099163","223821417830448212039471960667645711940","96061646228493967933743881295113944803","158138816801430100227923045220066274706","172335261322976612414996337317265314415","284930258187026851685744393771718598710","84897957719793763378787010771828216269","18345001897566117917453675981579903891","310615547299207451880067539599874680910","18260596158844744111567488787920303588","250668510250923319230897321365068606907","220884027888050459794073188008898298494","9155835743574194240451287805104643473","115765600512490140712093755722920212947","309137123707191894278201440707518561543","214247774765079579737470656476303401454","339075001706789294331542645720530159169","84587351606367527360834418902354493440","199180319962527981817044378409616228139","24981488014315268602782654406832267628","332905461496713582164535589763867744029","190987627303244527594504637996469584688","284978841136212485963750519597129388894","316049636762019681385812218658946241873","320753731992898367532777951024134678848","64297596093582670781544638716951688011","20844625784302354356675616870728844172","308885963931199585901406111857095420936","175603607796103174214748304054650793686","218020514103498334346461754264308257504","318365589609690343892411004041713443812","293666709672950281115090300515512042926","327461355754951232534274694429674468899","111190431246669682603636693337021014635","332048581456276706005029451092522050953","21019106461687158185645014123403664025","284349422991610566496306516921311024553","67428226244258703343489172800092523115","15829734903048153117257021907708629745","204882251574157324298934762999522731648","251732615608553544385237013890877805151","202817635421361926110949211569297691137","162861595061387021764123875367344674179","216046027862035527222450824153937800564","47418894562351247966599542938913314296","181615981390272897957052050740349456434","36640998398272581907953808485257211355","184308593883811142765316582812074363174","336698271793475661581055485453799228884","144461696452311670103652583887273124903","268106854363147347957056127332407592782","108849777749747018457519434488600045895","309010962180120397490622012343150247475","143394630530633037646225962872888272898","102068333269081213815046680531967402941","325403844720370948395563647673129398497","178648971782450014751896141016131053428","241026367816041896264044128727639044875","147007442248353363778887076328919926387","21164248714281988851248209112251389299","87219304782664468817648422649607185936","218849460080296194139342008188447257059","156019615997682253153947299971794417110","329344399103256899138783408987738504308","120519432895944166947854169556015520937","204215240036393422506616934802227434994","129597914760737217038321954575679231810","104917760585666877630149154507523132241","7046738916798274381296027664021074344","298796290967899776127296667242173908867","221203912202447604357786860986577166729","169405804969294408139754470145867460230","109623748887006051927461013669934390578","135608866728650664417430765896856361793","110098117075134408239104951431792248895","258998604720398680898870666869094178377","210232646366101892464281567198820429049","109666253106412792457704375484377913986","212193108993360547024474288443601361670","84455473685555146888451789769529027632","149033630399585440599543749099853564727","37425645629839673963993391651509255126","42427120086193091714233433936689471296","312736922824794935872700229865274404083","13878688442893199014972521896157788613","60334011953119813167598596462987489751","110006463270753763661026906248930674997","225125281590295285149941657688350032402","53418119095185916646857243700509814915","246925655395008488356796588233668588791","106150167108981686407894261368750217031","43727886670199161363948942721651123005","259524158409842524968364362927012380572"],"threshold":0.9}},{"digest":{"function_hash":"150041839037741097942245791796200147774","length":898},"id":"CVE-2025-59147-bfdf1b8a","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"file":"src/stream-tcp.c","function":"TcpStateQueueInitFromPktSyn"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e","target":{"file":"src/stream-tcp.c","function":"StreamTcpPacketStateSynSent"},"deprecated":false,"digest":{"function_hash":"278677384759524702780249538487706221543","length":11187},"id":"CVE-2025-59147-c8129105","signature_type":"Function"},{"source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"file":"src/stream-tcp.c","function":"TcpStateQueueInitFromPktSynAck"},"deprecated":false,"digest":{"function_hash":"150041839037741097942245791796200147774","length":898},"id":"CVE-2025-59147-d4c6cf3d","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b","target":{"function":"StreamTcp3whsStoreSynApplyToSsn","file":"src/stream-tcp.c"},"deprecated":false,"digest":{"function_hash":"175897116486016775792850450411611982595","length":806},"id":"CVE-2025-59147-e7c823da"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}