Suricata CVE-2026-31935

Remote unauthenticated attacker can flood crafted HTTP/2 continuation frames across the network to Suricata IDS/IPS engine versions prior to 7.0.15 and 8.0.4, causing memory exhaustion and denial of service. No victim interaction required.

This vulnerability presents HIGH real-world risk for organizations relying on Suricata for network security monitoring. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote exploitation with low attack complexity requiring no authentication or user interaction, enabling trivial attacks against exposed Suricata deployments. The attack is highly automatable and could be integrated into botnets or used as a precursor to further attacks by blinding network defenses. While CVSS 7.5 reflects only availability impact (A:H), the security consequence is severe: rendering IDS/IPS systems inoperative creates a detection blind spot for subsequent malicious activity. SSVC technical impact would be classified as partial (denial of service to critical security infrastructure). No CISA KEV listing indicates no confirmed widespread active exploitation, but the straightforward attack vector and availability of HTTP/2 testing tools lower the barrier to exploitation. Organizations using Suricata in production IPS mode face immediate operational risk, as process termination would disrupt network traffic inspection and potentially inline blocking capabilities.

An external attacker identifies a target organization running vulnerable Suricata as an inline IPS or network monitoring sensor. The attacker establishes an HTTP/2 connection to any service monitored by Suricata and floods the connection with maliciously crafted CONTINUATION frames designed to fragment headers across thousands of frames. Suricata's parser processes each frame without adequate memory bounds checking, rapidly consuming available system memory. Within minutes, the operating system's out-of-memory killer terminates the Suricata process, disabling network intrusion detection and prevention capabilities. With security monitoring blinded, the attacker proceeds with subsequent attacks (malware deployment, data exfiltration, lateral movement) confident that activity will go undetected. The attack requires only standard HTTP/2 client libraries and no authentication, making it trivially automatable.