CVE-2026-45759

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Suricata via HTTP Content-Disposition Parsing

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP `Content-Disposition` headers during HTTP response body processing. Crafted HTTP traffic could cause excessive CPU usage and denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, use a rule like `alert http1 any any -> any any (sid: 1; http.request_header; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;)`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45759

Affected Vendors & Products

Vendor	Product	Version / Range
oisf	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that can be overwhelmed by crafted HTTP traffic due to excessive parsing of large HTTP Content-Disposition headers in HTTP responses. This causes high CPU usage and potential denial of service.

Detection Guidance

Monitor Suricata logs for excessive CPU usage during HTTP traffic processing. Check for repeated parsing of large Content-Disposition headers in HTTP responses. Use network monitoring tools to detect abnormal traffic patterns targeting HTTP headers.

Impact Analysis

The vulnerability can lead to system slowdowns, service disruptions, or complete denial of service due to excessive CPU consumption when processing malicious HTTP traffic.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or 8.0.5 or later. Apply the workaround rule: alert http1 any any -> any any (sid: 1; http.request_header; content: "Content-Disposition:"; startswith; bsize: > 8192; bypass;). Monitor system performance to ensure mitigation is effective.

Hi! I’m here to help you understand CVE-2026-45759. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70