CVE-2026-46387: Suricata http2: decompression bomb can cause denial of service in Suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Configuration
As a workaround, disable HTTP/2 in Suricata to avoid the HTTP/2 decompression path that can allocate excessive memory while decompressing crafted payloads.
Suricata HTTP2 HTTP2 = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Suricata deployments running versions earlier than 7.0.16 or 8.0.5 are affected when processing HTTP/2 traffic. The issue is in the HTTP/2 decompression path.
What does an attacker need to do to trigger the issue?
An attacker can send a crafted HTTP/2 DATA payload with a high compression ratio, using formats such as gzip, deflate, or brotli. No privileges or user interaction are required.
What is the impact on an affected sensor?
Suricata may allocate excessive memory while decompressing the response body because the decompressed buffer can grow without an effective upper bound. This can cause a denial of service.
What can be done if upgrading is not immediately possible?
Disable HTTP/2 as a workaround. Upgrading to Suricata 7.0.16 or 8.0.5 resolves the issue.