Suricata EUVD-2026-75757

Exploitation requires that Suricata be actively inspecting HTTP/2 traffic - i.e., the HTTP/2 app-layer parser must be enabled (the default) and the sensor must see attacker-influenced HTTP/2 flows on a monitored link or inline IPS path. The specific trigger is a protocol change during HTTP/2 processing. Limiting factors: environments that have disabled HTTP/2 parsing, or where Suricata does not observe HTTP/2 traffic, are not exposed; no authentication or user interaction is needed otherwise. Affected only on versions prior to 7.0.16 and 8.0.5.

The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting unauthenticated, low-complexity network reachability. However, the description characterizes the impact solely as a crash/denial of service, so the A:H rating is well supported but the I:H (high integrity) rating appears overstated - a type-confusion crash does not clearly imply integrity compromise, and no code-execution primitive is claimed by the vendor; a DoS-only assessment (~7.5) is more defensible. No EPSS, KEV, or POC signal is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. That said, because Suricata is a security control, a crash blinds detection/prevention, so any mid-sized operator running HTTP/2 inspection should patch promptly even absent an exploit, treating loss of monitoring as a meaningful security event rather than mere downtime.

An unauthenticated attacker sends crafted HTTP/2 traffic - including a mid-stream protocol change - across a network segment monitored by Suricata (or through a Suricata-protected IPS path). The malformed sequence triggers the type-confusion fault, crashing the engine and creating a detection/prevention blind spot the attacker can exploit for follow-on activity. No public POC is identified at time of analysis, but the low attack complexity makes reliable triggering plausible once the code path is understood.