How many CVEs does OISF have?

OISF has 88 published CVE records since 2014, including 35 in the last two years.

How many OISF CVEs are in CISA KEV?

None of OISF's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which OISF products have the most CVEs?

The OISF products with the most published CVEs are suricata, libhtp, suricata-update.

What are the most common weakness types in OISF CVEs?

OISF's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-121 (Stack-based Buffer Overflow), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption).

Are there public exploits for OISF vulnerabilities?

Yes — 3 of OISF's CVEs have a known public exploit.

How many critical OISF vulnerabilities are there?

OISF has 11 critical and 63 high-severity CVEs.

What is the average severity of OISF CVEs?

The average CVSS base score across OISF's scored CVEs is 7.5.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

88 CVEs

OISF Vulnerabilities

Name: OISF vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for OISF.

88

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

3

Public exploits

PoC or exploit code

7.5

Avg CVSS

2014–2026

Overview

OISF has 88 published CVE records since 2014, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting OISF products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on OISF's vulnerability posture, as a share of its 88 published CVEs.

Average CVSS: 7.5
Critical / high: 84%
Actively exploited (KEV): 0%
Public exploit available: 3%
Patch available: 100%

Severity and exploitation

How the CVSS severity of OISF's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical11

High63

Medium14

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OISF's CVEs are currently listed in CISA's KEV catalog.

Public exploits

3

3 of OISF's CVEs have a known public exploit available.

Most affected products

The OISF products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in OISF CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish OISF CVE records.

Disclosure activity by year

How many OISF CVEs were published each year.

2018

5

2019

16

2020

2

2021

3

2023

3

2024

20

2025

22

2026

13

Latest OISF CVEs

The most recently disclosed vulnerabilities affecting OISF.

Suricata dcerpc: quadratic complexity in dcerpc buffering
CWE-407
High · CVSS 7.5
EPSS 0.4%2026-04-02
Suricata http2: unbounded resource consumption
CWE-400
High · CVSS 7.5
EPSS 0.3%2026-04-02
Suricata smtp/mine: quadratic complexity in extracting urls
CWE-407
High · CVSS 7.5
EPSS 0.3%2026-04-02
Suricata stream: quadratic complexity in stream inspection
CWE-407
High · CVSS 7.5
EPSS 0.4%2026-04-02
Suricata krb5: quadratic complexity in krb5 buffering
CWE-407
High · CVSS 7.5
EPSS 0.3%2026-04-02
Suricata tls: null dereference in tls.alpn rule keyword
CWE-476
High · CVSS 7.5
EPSS 0.4%2026-04-02
Suricata detect/alert: heap-use-after-free on alert queue expansion
CWE-416
Critical · CVSS 9.1
EPSS 0.3%2026-01-27
Suricata http1: quadratic complexity in headers parsing over multiple packets
CWE-1050
Medium · CVSS 5.3
EPSS 0.4%2026-01-27
Suricata datasets: stack overflow when saving a set
CWE-121
Critical · CVSS 9.8
EPSS 0.5%2026-01-27
Suricata eve/alert: http1 xff handling can lead to denial of service
CWE-1050
Medium · CVSS 5.3
EPSS 0.3%2026-01-27
Suricata http1: infinite recursion in decompression
CWE-674
High · CVSS 7.5
EPSS 0.5%2026-01-27
Suricata dnp3: unbounded transaction growth
CWE-400
High · CVSS 7.5
EPSS 0.5%2026-01-27

Track new OISF CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor OISF CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Veeam88 CVEs Fujitsu88 CVEs 1000projects88 CVEs otfcc project88 CVEs Pandora FMS88 CVEs pickplugins88 CVEs siyuan-note88 CVEs Tips and Tricks HQ88 CVEs

Browse all vendors

Frequently asked questions

Common questions about OISF vulnerabilities.

How many CVEs does OISF have?: OISF has 88 published CVE records since 2014, including 35 in the last two years.
How many OISF CVEs are in CISA KEV?: None of OISF's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which OISF products have the most CVEs?: The OISF products with the most published CVEs are suricata, libhtp, suricata-update.
What are the most common weakness types in OISF CVEs?: OISF's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-121 (Stack-based Buffer Overflow), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption).
Are there public exploits for OISF vulnerabilities?: Yes — 3 of OISF's CVEs have a known public exploit.
How many critical OISF vulnerabilities are there?: OISF has 11 critical and 63 high-severity CVEs.
What is the average severity of OISF CVEs?: The average CVSS base score across OISF's scored CVEs is 7.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track OISF vulnerabilities

Monitor new OISF vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing