CVE-2026-71418: Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricata (doh2 / rust/src/http2/http2.rs)to a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Suricata deployments running versions from 8.0.0 until the 8.0.6 fix are affected when they process DNS-over-HTTP/2 traffic. The issue is in the DNS-over-HTTP/2 processing path.
What must an attacker be able to do?
An attacker needs to send crafted HTTP/2 DATA frames to traffic processed by Suricata. No privileges or user interaction are required according to the supplied vector.
What is the operational impact of exploitation?
Repeated DATA frames with the EndOfStream flag can force quadratic CPU consumption as previously processed content is handled again. This can degrade packet processing, create monitoring blind spots, or cause denial of service.
How can this be remediated?
Upgrade Suricata to version 8.0.6, which fixes the issue.