CVE-2026-63452: Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.6 - Configuration
Enable response-body-decompress-layer-limit to limit decompression work for repeated compressed responses and avoid expensive decompression work in rust/htp on every transaction.
Suricata http1 response-body-decompress-layer-limit = enabled
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Suricata versions 8.0.0 through 8.0.5 are affected when response-body-decompress-layer-limit is enabled. Version 8.0.6 contains the fix.
What must an attacker be able to do to trigger the issue?
An attacker needs to send repeated small Brotli-compressed HTTP/1 responses over a single flow observed by Suricata. The provided severity vector indicates network reachability is sufficient and no privileges or user interaction are required.
How can I quickly assess exposure before upgrading?
Check the deployed Suricata version and whether response-body-decompress-layer-limit is enabled. Systems running an affected version with that setting enabled should be prioritized for remediation.