CVE-2025-53538: Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; bytetest:1,=,0,3; bytetest:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53538?
CVE-2025-53538 is considered a high-severity vulnerability due to the potential for uncontrolled memory usage.
How do I fix CVE-2025-53538?
To fix CVE-2025-53538, update Suricata to version 7.0.11 or later, or to a release beyond 8.0.0-rc1.
What versions of Suricata are affected by CVE-2025-53538?
CVE-2025-53538 affects Suricata versions 7.0.10 and below as well as 8.0.0-beta1 through 8.0.0-rc1.
What type of vulnerability is CVE-2025-53538?
CVE-2025-53538 is a vulnerability related to memory management issues in the HTTP2 stream handling.
Can CVE-2025-53538 lead to a denial of service?
Yes, CVE-2025-53538 can potentially lead to a denial of service due to excessive memory consumption.