CVE-2026-46387
Received Received - Intake

Memory Exhaustion in Suricata HTTP/2 Decompression

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-46387
EUVD
EUVD-2026-75508

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oisf suricata to 7.0.16|end_excluding=8.0.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Suricata is a network security tool vulnerable to a denial of service attack due to improper handling of highly compressed HTTP/2 data. The issue occurs when Suricata's HTTP/2 decompression mechanism allocates excessive memory while processing crafted DATA payloads with high compression ratios like gzip, deflate, or brotli. This can lead to memory exhaustion and service disruption.

Detection Guidance

Monitor Suricata logs for excessive memory usage or crashes during HTTP/2 traffic processing. Check for HTTP/2 DATA payloads with high compression ratios (gzip, deflate, brotli). Use network monitoring tools like Wireshark to inspect HTTP/2 traffic for unusually large decompressed payloads.

Impact Analysis

This vulnerability can cause your Suricata instance to consume excessive memory, leading to system slowdowns or crashes. It may disrupt network monitoring and security operations, potentially allowing attackers to bypass detection or cause service outages.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by causing service disruptions due to memory exhaustion. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates continuous access to protected health information. A denial-of-service condition may violate these requirements by disrupting system availability.

Mitigation Strategies

Upgrade Suricata to versions 7.0.16 or 8.0.5 or later. Alternatively, disable HTTP/2 support in Suricata configuration. Monitor system memory usage and Suricata processes for signs of exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart