Suricata EUVD-2026-75754

Suricata must have HTTP inspection active and be processing HTTP/1 traffic on the monitored network segment. The attacker must be able to cause HTTP response traffic containing oversized Content-Disposition headers to traverse the segment Suricata inspects - either by controlling an HTTP server reachable from internal clients, by performing a man-in-the-middle injection into HTTP sessions, or by directing an internal host to fetch attacker-controlled content. No authentication against Suricata itself is required; PR:N confirmed by CVSS vector. Limiting factors: the attack path requires HTTP/1 traffic (not HTTP/2 or TLS-only paths) to reach a Suricata inspection point, and the impact is confined to Suricata's availability - underlying network hosts and services remain unaffected unless the IPS is inline and configured to block on engine failure.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the threat: unauthenticated network exploitability, low complexity, and pure availability impact. EPSS data was not provided in the input, so exploitation probability cannot be quantified numerically. No KEV listing and no POC availability have been identified, suggesting opportunistic exploitation is not currently occurring. Raw CVSS understates the operational significance in one respect: the victim is the security monitoring layer itself. An attacker who can CPU-starve Suricata gains a detection blind spot, effectively using the DoS as a precursor to unmonitored malicious activity. This elevates practical risk in IPS-inline deployments beyond what a standalone 7.5 DoS score implies. In IDS-passive deployments the operational impact is lower (traffic flows unimpeded but uninspected). The workaround rule trades off detection coverage against CPU exhaustion, so defenders face a genuine dilemma until patched.

An attacker controlling or compromising an HTTP server whose responses are inspected by a Suricata-monitored network segment crafts responses with Content-Disposition headers exceeding 8192 bytes, designed to maximize re-parsing cost. Repeated delivery of these responses causes Suricata's inspection workers to spin on CPU-intensive parsing, progressively degrading throughput until inspection stalls or the engine falls critically behind real-time traffic. In an IPS-inline deployment this effectively blinds the detection layer, enabling follow-on intrusion activity to pass undetected. No public proof-of-concept has been identified at time of analysis.