Suricata EUVD-2026-75508

Suricata must be actively inspecting HTTP/2 traffic, which requires that HTTP/2 application-layer parsing and decompression be enabled - this is the default configuration in current Suricata versions. The attacker must be able to route HTTP/2 traffic through a network segment monitored by the vulnerable Suricata sensor, either by controlling a web server that clients on the monitored network connect to, or by performing a MITM on existing HTTP/2 sessions. No authentication to Suricata is required, and no client-side user interaction is needed beyond the client initiating an HTTP/2 connection. Exploitation is limited to networks where Suricata is deployed and where the attacker can influence HTTP/2 response content visible to the sensor; deployments with HTTP/2 disabled (via workaround) are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5, which accurately characterizes the risk profile: fully remote, unauthenticated, zero-click, and trivially repeatable with no special conditions beyond routing traffic through a Suricata sensor. The impact is purely on availability (A:H), with no confidentiality or integrity consequence. No CISA KEV listing and no public exploit code have been identified, keeping this below immediate emergency priority; however, the attack is straightforward to construct - any attacker who can inject or serve HTTP/2 content through a monitored segment can trigger it. For organizations where Suricata is deployed inline as an IPS, a successful attack removes network visibility and enforcement, which is a significant operational and security consequence. EPSS data is not provided; absent it, the low exploit complexity and high-value target (network security infrastructure) suggest meaningful real-world exploitation probability. Patching is the clear mitigation given the simplicity of the vector.

An attacker who controls a web server reachable by hosts on a monitored network (or who can perform a man-in-the-middle on HTTP/2 traffic) crafts an HTTP/2 DATA frame carrying a small but highly compressed payload - analogous to a zip bomb - with a compression ratio of thousands-to-one. When a client on the monitored segment fetches this resource, Suricata decompresses the response body without bound, rapidly consuming available system memory and causing the IDS/IPS process to be killed by the OS OOM killer or to become unresponsive, blinding the network defense layer. No public proof-of-concept is required to execute this; the technique is well-understood and any HTTP/2-capable server can serve such a response.