Network Security Monitoring Vulnerability in Suricata by Open Information Security Foundation

CVE-2026-71418

What is CVE-2026-71418?

The vulnerability in Suricata involves how DNS-over-HTTP/2 processing retains previously processed HTTP/2 DATA frame contents. This flaw leads to an unregulated growth of the internal buffer due to multiple DATA frames with the EndOfStream flag set. As the buffer approaches its 65 KiB limit, this can result in quadratic CPU complexity. The consequence includes degraded packet processing, potential loss of monitoring visibility, and increased risk of denial of service. A fix has been implemented in version 8.0.6.

References