An issue was discovered in Suricata 4.1.3.

published 2019-08-28 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2119

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

Patch / fix

distros 1

suricata Debian 14, Debian 13 1:4.1.4-1

debian advisories DEBIAN-CVE-2019-10056

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10056 updated 2025-11-21 cvss 7.5

suricata: denial of service in function DecodeEthernet in decode-ethernet.c

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

redmine.openinfosecfoundation.org https://redmine.openinfosecfoundation.org/issues/2946 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

CWE-787 Out-of-bounds Write

References

redmine.openinfosecfoundation.org /issues/2946
exploit, issue-tracking, third-party-advisory
suricata-ids.org /2019/04/30/suricata-4-1-4-released/
not-applicable, release-notes, vendor-advisory

Sources

CVE List CVE-2019-10056
NVD CVE-2019-10056

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary