CVE-2021-45098

    Dashboard / Vulnerabilities / CVE-2021-45098

    CVE-2021-45098

    Published: 16 Dec 2021Last Modified: 8 Jul 2026

    Summary:

    Details: An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.

    References: https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html, https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942, https://github.com/OISF/suricata/releases, https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97df, https://redmine.openinfosecfoundation.org/issues/4710

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e9c8767b905fcae53432076572bfbeaf639b202d

    Affected versions

    suricata-6.0.3
    suricata-6.0.2
    suricata-6.0.1
    suricata-6.0.0
    suricata-6.0.0-rc1
    suricata-6.0.0-beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-45098 | CVE-DB