Description
An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | suricata | 3.1.2-1 | — |
| Debian 13 | suricata | 3.1.2-1 | — |
| Debian 8 | suricata | 2.0.7-2+deb8u2 | DLA-1508-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | suricata | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | suricata | 8.0.0-1.1 | openSUSE-SU-2025:15394-1 |
Advisories 2
- openSUSE-SU-2025:15394-1 libsuricata8_0_0-8.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-1508-1 suricata - security update Debian Security (DSA / DLA) · Mar 9, 2026