CVE-2024-37151 MEDIUM

CVE-2024-37151: Suricata defrag: IP ID reuse can lead to policy bypass

Vendor Oisf
Product suricata
Weakness CWE-754
Published July 11, 2024
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.

Key dates

02Disclosure timeline

July 11, 2024 CVE published
November 3, 2025 Record updated