CVE-2026-31934
Quadratic Complexity in Suricata SMTP URL Parsing Causes Performance Degradation
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oisf | suricata | From 8.0.0 (inc) to 8.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-407 | An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Suricata (CVE-2026-31934) primarily causes a performance impact leading to potential denial of service by exhausting system resources. It does not directly affect confidentiality or integrity of data.
Since the vulnerability does not involve data breaches, unauthorized access, or data manipulation, it does not directly impact compliance with common standards and regulations such as GDPR or HIPAA, which focus on protecting personal and sensitive data.
However, the availability impact could indirectly affect compliance if the Suricata system is critical for monitoring and protecting network traffic as part of an organization's security controls required by these regulations.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a high availability risk. Because the algorithm has quadratic complexity, an attacker can cause Suricata to consume excessive system resources when processing specially crafted SMTP MIME messages.
This can lead to a denial of service (DoS) condition, where Suricata's performance is severely degraded or the system becomes unresponsive, potentially disrupting network security monitoring and intrusion detection capabilities.
Can you explain this vulnerability to me?
CVE-2026-31934 is a vulnerability in Suricata, a network IDS, IPS, and NSM engine, affecting versions 8.0.0 to before 8.0.4. The issue occurs in the SMTP MIME URL extraction functionality, where the algorithm used to search for URLs has quadratic time complexity. This means that under certain conditions, processing MIME-encoded messages over SMTP can cause significant performance degradation.
An attacker can exploit this vulnerability remotely without any privileges or user interaction by crafting inputs that trigger the worst-case computational complexity, leading to a denial of service by exhausting system resources.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to a performance impact caused by a quadratic complexity issue in Suricata when processing MIME-encoded SMTP messages with URL extraction enabled.
Detection can involve monitoring Suricata's performance metrics for unusual CPU or memory usage spikes during SMTP traffic analysis, especially when the "extract-urls" setting is enabled in the SMTP app-layer configuration.
While no specific commands are provided in the resources, you can check your Suricata version with:
- suricata --build-info
and monitor system resource usage during SMTP traffic with standard tools such as:
- top or htop (to observe CPU and memory usage)
- netstat or ss (to monitor network connections)
- suricata logs for any performance warnings or errors
Additionally, reviewing Suricata's SMTP app-layer configuration to see if "extract-urls" is enabled can help identify if the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Suricata to version 8.0.4 or later, where this quadratic complexity issue has been patched.
As an immediate workaround before upgrading, you can disable the "extract-urls" setting in the SMTP app-layer configuration to prevent exploitation of this vulnerability.
These steps will help prevent potential denial of service caused by the inefficient URL extraction algorithm.