suricata — 5-MOAD scan results

Target: https://github.com/OISF/suricata (depth=1)
Language: C
Date: 2026-03-31
Scanned by: agent blackops

MOAD-0001 CWE-407 (linear scan in loop):
  CLEAN. Suricata uses bitarrays (SigGroupHead sig_array), hash tables
  (SigGroupHeadHashTable, MpmInitHash, THashLookupFromHash with HRLOCK),
  and red-black trees (TCPSEG, SBB) throughout hot paths. Merge-sort
  (O(N log N)) is used for signature ordering. No O(N^2) per-packet path
  found. The probing parser port list scan is O(P) with P < 50 entries.

MOAD-0002 Intertangle:
  CLEAN. Subsystems are cleanly separated. The detection engine uses a
  per-tenant DetectEngineCtx. App-layer parsers run in their own context.
  Global registration lists (g_app_inspect_engines etc.) are write-once
  at startup and read-only thereafter. No god object coupling independent
  subsystems through shared mutable state.

MOAD-0003 Leaked Context:
  CLEAN. All thread_local variables hold thread-scoped data:
  thread_pkt_pool (packet pool), t_thread_name (thread identifier),
  pcap_file_thread (output file handle), tcp_pool_cache (segment pool),
  locks[] (lock profiling). None holds request-scoped identity that
  could leak across flow or packet boundaries.

MOAD-0004 CWE-312 (credentials logged verbatim):
  DEFECT — see defects/suricata-0001/ for patch and test.
  EveHttpLogJSONHeaders() in src/output-json-http.c logs all header values
  verbatim when dump-all-headers is enabled or when a custom field list
  includes credential headers. The default suricata.yaml.in shows
  "Authorization" as a custom field example with no warning. At runtime:
  Authorization (Bearer/Basic tokens), Proxy-Authorization, Cookie
  (session tokens), and Set-Cookie values appear in eve.log in cleartext.

MOAD-0005 Thundering Herd:
  CLEAN. THashLookupFromHash acquires a per-row HRLOCK before any read
  or write. THashAdd uses the same HRLOCK. No get+null+compute+put
  race window exists. Flow hash (FlowGetFlowFromHash) also uses per-bucket
  mutex (FBLOCK_LOCK). No concurrent cache unsynchronized race found.

Summary: 1 defect (suricata-0001 MOAD-0004 CWE-312 MEDIUM)