CVE-2025-29918 MEDIUM

CVE-2025-29918: Suricata pcre: negated pcr can cause infinite loop

Vendor Oisf
Product suricata
Weakness CWE-835
Published April 10, 2025
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.

Key dates

02Disclosure timeline

April 10, 2025 CVE published
November 3, 2025 Record updated