{"id":"CVE-2026-63450","summary":"Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection","details":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.","aliases":["GHSA-56wx-7hqh-wfgr"],"modified":"2026-09-20T08:19:42.969410Z","published":"2026-09-18T20:13:42.549Z","database_specific":{"cwe_ids":["CWE-755"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63450.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"},{"type":"WEB","url":"https://redmine.openinfosecfoundation.org/issues/8659"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63450.json"},{"type":"ADVISORY","url":"https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63450"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc"},{"type":"FIX","url":"https://github.com/OISF/suricata/pull/15704"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/suricata","events":[{"introduced":"0"},{"fixed":"52490b8c26909772801afed98df63a6d62f3af18"},{"fixed":"feb0ff91159cea474a983adf92e4b56fb16e4ffc"},{"fixed":"4c28cc1b4ac64f48efdca6ce3e09748227a04a7e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"8.0.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["suricata-8.0.5","suricata-8.0.4","suricata-8.0.3","suricata-8.0.2","suricata-8.0.1","suricata-8.0.0","suricata-8.0.0-rc1","suricata-8.0.0-beta1","suricata-7.0.2","suricata-7.0.1","suricata-7.0.0","suricata-7.0.0-rc2","suricata-7.0.0-rc1","suricata-7.0.0-beta1","suricata-6.0.1","suricata-6.0.0","suricata-6.0.0-rc1","suricata-6.0.0-beta1","suricata-5.0.1","suricata-5.0.0","suricata-5.0.0-rc1","suricata-5.0.0-beta1","suricata-4.1.2","suricata-4.1.1","suricata-4.1.0","suricata-4.1.0-rc2","suricata-4.1.0-rc1","suricata-4.1.0-beta1","suricata-4.0.1","suricata-4.0.0","suricata-4.0.0-rc2","suricata-4.0.0-rc1","suricata-4.0.0-beta1","suricata-3.2.1","suricata-3.2","suricata-3.2RC1","suricata-3.2beta1","suricata-3.1.2","suricata-3.1.1","suricata-3.1","suricata-3.0.1","suricata-3.1RC1","suricata-3.0.1RC1","suricata-3.0","suricata-3.0RC3","suricata-3.0RC2","suricata-3.0RC1","suricata-2.1beta4","suricata-2.1beta3","suricata-2.1beta2","suricata-2.1beta1","suricata-2.0.2","suricata-2.0.1","suricata-2.0.1rc1","suricata-2.0","suricata-2.0rc3","suricata-2.0rc2","suricata-2.0rc1","suricata-2.0beta2","suricata-2.0beta1","suricata-1.4","suricata-1.4rc1","suricata-1.4beta3","suricata-1.4beta2","suricata-1.4beta1","suricata-1.3.1","suricata-1.3","suricata-1.3rc1","suricata-1.3beta2","suricata-1.3beta1","suricata-1.2.1","suricata-1.2","suricata-1.2rc1","suricata-1.2beta1","suricata-1.1","suricata-1.1rc1","suricata-1.1beta3","suricata-1.1beta2","suricata-1.1beta1","suricata-1.0.2","suricata-1.0.1","suricata-1.0.0","suricata-0.8.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63450.json","vanir_signatures_modified":"2026-09-20T08:19:42Z","vanir_signatures":[{"id":"CVE-2026-63450-3800cb19","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc","target":{"file":"src/app-layer-ftp.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["244549085848019103372699667501287813289","101316997624955885597169713427148656473","229804974527284673831317926575230165429","188911533313708387790507482678930005088","233023409235403746012393350048634578097","178694115340285039665601313512602161893","111927208127394748596514883453597296782","101145428851310850897010739463836320815","253366340631146633858735977982706362152","178694115340285039665601313512602161893","111927208127394748596514883453597296782","101145428851310850897010739463836320815","65095813435242428812117689428043838325"]}},{"deprecated":false,"digest":{"function_hash":"65576718931112081214663914007372563998","length":949},"id":"CVE-2026-63450-45848e3e","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18","target":{"file":"src/app-layer-ftp.c","function":"FTPParserTest11"}},{"deprecated":false,"digest":{"function_hash":"72404163132729954599422803072459313654","length":3550},"id":"CVE-2026-63450-8edaa65c","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18","target":{"file":"src/app-layer-ftp.c","function":"FTPParseRequest"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18","target":{"function":"FTPParserTest12","file":"src/app-layer-ftp.c"},"deprecated":false,"digest":{"function_hash":"156635524848708387203428801439829578351","length":949},"id":"CVE-2026-63450-9cd247a8"},{"deprecated":false,"digest":{"line_hashes":["244549085848019103372699667501287813289","101316997624955885597169713427148656473","229804974527284673831317926575230165429","188911533313708387790507482678930005088","233023409235403746012393350048634578097","178694115340285039665601313512602161893","111927208127394748596514883453597296782","101145428851310850897010739463836320815","253366340631146633858735977982706362152","178694115340285039665601313512602161893","111927208127394748596514883453597296782","101145428851310850897010739463836320815","65095813435242428812117689428043838325"],"threshold":0.9},"id":"CVE-2026-63450-ad8f9cd9","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18","target":{"file":"src/app-layer-ftp.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc","target":{"file":"src/app-layer-ftp.c","function":"FTPParserTest11"},"deprecated":false,"digest":{"function_hash":"73481979941350807377940868778184315014","length":928},"id":"CVE-2026-63450-b2a3ff00"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc","target":{"file":"src/app-layer-ftp.c","function":"FTPParserTest12"},"deprecated":false,"digest":{"function_hash":"311754298190697361884889919580468299157","length":928},"id":"CVE-2026-63450-c4917f47","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"146972927361912668111208840858346684765","length":3511},"id":"CVE-2026-63450-cd624125","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc","target":{"file":"src/app-layer-ftp.c","function":"FTPParseRequest"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}