CVE-2026-63450 Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection

Low 3.7 Published 18 Sep 2026 Updated 23 Sep 2026

Attackers can bypass Suricata's FTP application-layer detection by sending RETR or STOR commands before PORT or PASV negotiation, evading security rules.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63450?

CVE-2026-63450 is a low-severity vulnerability in Oisf Suricata, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.

Weakness: CWE-755

Which versions are affected by CVE-2026-63450?

It affects 1 product.

Products include Oisf Suricata.

How do I fix CVE-2026-63450?

Upgrade to a fixed version.

Is CVE-2026-63450 being exploited?

There is no known exploitation of CVE-2026-63450 in the wild and no public exploit code.

All Oisf Suricata vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-63450, GHSA-56wx-7hqh-wfgr, UBUNTU-CVE-2026-63450.