CVE-2026-45759: Suricata http1: quadratic Content-Disposition processing can lead to denial of service
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTTP traffic could cause excessive CPU usage and denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, use a rule like alert http1 any any -> any any (sid: 1; http.requestheader; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Compensating control
As a workaround, use a Suricata rule to alert on large HTTP Content-Disposition headers, e.g., `alert http1 any any -> any any (sid: 1; http.request_header; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;)` to mitigate excessive CPU usage/DoS.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Suricata versions before 7.0.16 and before 8.0.5 are affected when processing HTTP response bodies containing large crafted Content-Disposition headers.
What does an attacker need to exploit the issue?
An attacker needs to send crafted HTTP traffic with large Content-Disposition headers. The listed vector indicates network exploitation with low complexity, no privileges, and no user interaction.
What can be done if upgrading is not immediately possible?
Use a rule such as `alert http1 any any -> any any (sid: 1; http.request_header; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;)` to bypass processing for Content-Disposition headers larger than 8192 bytes.
How can I determine whether a system needs remediation?
Check the installed Suricata version. Upgrade if it is earlier than 7.0.16 in the 7.0 series or earlier than 8.0.5 in the 8.0 series.