Executive brief
Suricata is a network security monitoring engine that inspects incoming traffic for threats. A flaw in its HTTP/2 decompression logic allows an attacker to send specially crafted compressed data that causes the system to allocate excessive memory without bounds, leading to denial of service and loss of monitoring visibility.
Technical details
The vulnerability is a decompression bomb attack (CWE-409: improper handling of highly compressed data) in Suricata's HTTP/2 response-body decompression path. The affected component fails to enforce an upper limit on the decompressed buffer size, allowing an attacker to craft an HTTP/2 DATA payload with high compression ratios (using gzip, deflate, or brotli) to trigger unbounded memory allocation. The attack requires network access to send malicious HTTP/2 traffic to a Suricata instance, with no authentication or user interaction needed. Successful exploitation causes denial of service by exhausting memory and disabling network monitoring. Patches are available in Suricata 7.0.16 and 8.0.5; users can mitigate by disabling HTTP/2 support.
Affected products
- OISF Suricata prior to 7.0.16 and 8.0.5
Timeline
- 2026-06-02: disclosed
- 2026-05-19: patched: Suricata 7.0.16 and 8.0.5 released