Suricata EUVD-2026-83397

Requires that the Suricata sensor (versions 8.0.0 through 8.0.5) is processing DNS-over-HTTP/2 (DoH) traffic through the affected rust/src/http2/http2.rs path - i.e., HTTP/2 application-layer inspection reaching the DoH handling code. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed once such traffic is inspected; the attacker only needs to send multiple HTTP/2 DATA frames with the EndOfStream flag set to grow the buffer toward its 65 KiB limit. Limiting factors: the sensor must actually see and parse HTTP/2/DoH traffic for the affected direction, and the impact is confined to availability (CPU exhaustion / dropped inspection), not data compromise.

All signals point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, low-complexity attack with pure availability impact and no confidentiality or integrity exposure - consistent with the CWE-407 (algorithmic/quadratic complexity) root cause where an uncleared 65 KiB HTTP/2 DATA buffer is reprocessed repeatedly. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation is not confirmed in the wild. The practical severity is tempered by a real precondition: the flaw only triggers when Suricata is actively parsing DNS-over-HTTP/2 (DoH) traffic, so the 'PR:N/UI:N' ease-of-attack applies only to sensors configured to inspect that traffic. The impact is a monitoring/IDS engine slowdown or DoS (loss of visibility), not host compromise - a real operational priority for network-security teams running affected 8.0.x sensors, but not a mass-exploitation, high-EPSS emergency. There are no conflicting signals in the vector versus description; both agree this is a remote availability/DoS issue.

An attacker who can cause DoH (DNS-over-HTTP/2) traffic to traverse a monitored network segment sends a stream containing multiple HTTP/2 DATA frames each with the EndOfStream flag set. Because Suricata 8.0.0-8.0.5 fails to clear its internal DoH buffer between frames, prior contents are reprocessed each time, driving quadratic CPU cost as the buffer approaches 65 KiB. Sustained crafted streams degrade packet processing and can starve the sensor, causing dropped inspection and loss of monitoring visibility or full denial of service. No public exploit code was identified at time of analysis.