Suricata

1. Summary

`parse_cip_reqresp_multiple` reads an attacker-controlled `u16` count and passes it directly to `count()`. The count can be as high as 65535, causing large allocation and many recursive CIP parsing iterations.

1. Affected Code

File: `rust/src/enip/parser.rs:228-256`

```rust
let (i, nb) = le_u16.parse(i)?; // attacker-controlled, max 65535
let (i, offset_list) = count(le_u16, nb.into()).parse(i)?; // Vec::with_capacity(nb)
```

1. Impact

`count()` pre-allocates a Vec with capacity `nb`, causing approximately 128KB heap allocation per packet plus up to 65535 recursive CIP parsing iterations. A small TCP packet with `nb=0xffff` can trigger significant CPU and memory consumption. In ICS environments with low traffic baselines, this can overwhelm a sensor.

1. Suggested Fix

Add an upper bound check on `nb`, for example:

```rust
if nb > MAX_CIP_SERVICES { return Err(...); }
```

1. Environment

Suricata main branch @ commit 367ca7f (post v8.0.1, May 15, 2026).

1. Credit

Reported by Chris Ramos.