Executive brief
Suricata is a network security monitoring and intrusion detection/prevention system used to protect enterprise networks by analyzing traffic patterns. A flaw in HTTP/2 protocol handling could allow an attacker to craft malicious network traffic that causes Suricata to crash, disabling security monitoring and leaving the network unprotected during the outage.
Technical details
The vulnerability is a type confusion flaw (CWE-843) in Suricata's HTTP/2 protocol parsing logic. When processing specially crafted HTTP/2 traffic, a protocol state change causes the application to access a resource using an incompatible type, leading to memory corruption and a crash. The vulnerability requires network-level access to send crafted packets and affects Suricata 7.0.x before 7.0.16 and 8.0.x before 8.0.5. No privilege escalation or user interaction is required. An attacker can trigger a denial of service by remotely sending malicious HTTP/2 frames. The fix is available in Suricata 7.0.16 and 8.0.5; as a temporary workaround, HTTP/2 parsing can be disabled.
Affected products
- OISF Suricata 7.0.x before 7.0.16, 8.0.x before 8.0.5
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Suricata 7.0.16 and 8.0.5 released with fixes