Executive brief
Suricata is a network security monitoring engine that analyzes traffic to detect and prevent intrusions. Attackers can send repeated small brotli-compressed responses through a single network connection to exhaust decompression resources, causing the monitoring system to slow down or stop analyzing packets, resulting in loss of security visibility or service outage.
Technical details
The HTTP/1 parser in Suricata 8.0.0–8.0.5 limits decompression work per individual transaction but does not limit the total number of compression bombs a single flow can submit. When response-body-decompress-layer-limit is enabled, attackers can craft multiple small compressed payloads that collectively consume excessive CPU during decompression, degrading packet processing. The vulnerability is fixed in version 8.0.6 by implementing per-flow compression bomb counting.
Affected products
- OISF Suricata 8.0.0 to 8.0.5
Timeline
- 2026-09-18: disclosed
- 2026-07-07: patched: fix committed to repository
- 2026-09-18: advisory