HTTP/2 Decompression Vulnerability in Suricata by Open InfoSec Foundation
CVE-2026-46387
What is CVE-2026-46387?
Suricata, a widely used network Intrusion Detection and Prevention System, is impacted by a vulnerability in its HTTP/2 decompression mechanism. Prior to versions 7.0.16 and 8.0.5, the system's response buffer could expand without limits when handling specially crafted HTTP/2 DATA payloads, particularly those utilizing compression algorithms like gzip, deflate, or brotli. This flaw leads to excessive memory allocation during the decompression process, potentially resulting in degraded performance or denial of service. Users are advised to update to the latest versions to mitigate this risk. As a temporary measure, disabling HTTP/2 can also serve as a workaround until the software is updated.
Affected Version(s)
suricata < 7.0.16 < 7.0.16
suricata >= 8.0.0, < 8.0.5 < 8.0.0, 8.0.5