CVE-2018-6794 is an HTTP detection bypass vulnerability affecting Suricata versions prior to 4.0.4, including Debian distributions. A malicious server can exploit this by sending data before the TCP 3-way handshake completes, causing Suricata IDS signatures to ignore this traffic while web clients accept it. This medium-severity vulnerability (CVSS 5.3) has a network attack vector, low complexity, and can lead to a loss of integrity by bypassing HTTP and TCP stream content inspections. While not actively exploited in the wild and lacking significant community discussion or media coverage, exploit code is publicly available via ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.0.4CPE matchmatch criteria | cpe:2.3:a:suricata-ids:suricata:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.