Suricata's defrag contains various issues leading to policy bypass

Suricata, a network security monitoring tool, has issues detecting fragmented network packets correctly, which could allow malicious traffic to bypass security rules. An attacker could craft fragmented packets to slip past the security monitoring system.

The vulnerability exists in Suricata's defragmentation handling logic prior to versions 7.0.5 and 6.0.19, where improper processing of fragmentation anomalies causes rule mismatches and policy bypass. An attacker can craft malformed IP fragments to evade intrusion detection/prevention rules. Impact includes circumvention of configured security policies for fragmented traffic detection.