Project

General

Profile

Actions

Bug #16841

closed

Suricata crashes when accessing 'Suricata -> Blocks' possible vulnerability in PHP.

Added by Andrew Rojek 6 days ago. Updated 6 days ago.

Status:
Duplicate
Priority:
Urgent
Assignee:
-
Category:
PHP Interpreter
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
Affected Architecture:
7100

Description

Hey Guys, Suricata generated this output today that has crashed the 'Suricata -> Blocks' option.
Looks like an obfuscation attempt. Could be consequences of an attack, see attached file.
I've tried stopping and restarting the interfaces but the issue has not resolved itself. May have to do a complete reinstall.

Crash report begins.  Anonymous machine information:

amd64
16.0-CURRENT
FreeBSD 16.0-CURRENT #36 plus-RELENG_26_03-n256531-4923e82e59d1: Fri Mar 20 18:22:49 UTC 2026     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-Plus-snapshots-26_03-main/obj/amd64/TVcqnR7U/var/jenkins/workspace/pfSe

Crash report details:

PHP Errors:
[13-May-2026 10:42:51 UTC] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1443
Stack trace:
#0 /etc/inc/util.inc(1443): ip2long()
#1 /etc/inc/util.inc(1386): is_ipaddrv4()
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr()
#3 {main}
  thrown in /etc/inc/util.inc on line 1443
[13-May-2026 11:27:29 UTC] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1443
Stack trace:
#0 /etc/inc/util.inc(1443): ip2long()
#1 /etc/inc/util.inc(1386): is_ipaddrv4()
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr()
#3 {main}
  thrown in /etc/inc/util.inc on line 1443
[13-May-2026 11:30:56 UTC] PHP Fatal error:  Uncaught ValueError: ip2long(): Argument #1 ($ip) must not contain any null bytes in /etc/inc/util.inc:1443
Stack trace:
#0 /etc/inc/util.inc(1443): ip2long()
#1 /etc/inc/util.inc(1386): is_ipaddrv4()
#2 /usr/local/www/suricata/suricata_blocked.php(399): is_ipaddr()
#3 {main}
  thrown in /etc/inc/util.inc on line 1443

No FreeBSD crash data found.

SYSTEM: XG7100U
PFSENSE: 26.03
KEYWORDS: ip2long, php


Files

20260513-suricata.log (107 KB) 20260513-suricata.log suricata.log of attacks Andrew Rojek, 05/13/2026 07:59 PM

Related issues

Is duplicate of Bug #16771: NULL bytes in an IP address can trigger PHP errors from ``ip2long()``ResolvedMarcos M

Actions
Actions

Also available in: Atom PDF