CVE-2026-31935
Description
A flaw was found in Suricata. A remote attacker can exploit this vulnerability by sending a flood of crafted HTTP2 continuation frames. This can lead to memory exhaustion, causing the Suricata process to shut down, resulting in a Denial of Service (DoS).
Statement
Important: A flaw in Suricata allows a remote attacker to trigger a Denial of Service. By sending a flood of specially crafted HTTP2 continuation frames, an attacker can cause memory exhaustion, leading to the Suricata process shutting down. This vulnerability affects Suricata deployments configured to inspect HTTP2 traffic.
Mitigation
To mitigate this issue, consider deploying Suricata behind a network firewall or load balancer capable of inspecting and rate-limiting HTTP/2 traffic. This can help prevent a flood of crafted HTTP/2 continuation frames from reaching the Suricata instance, thereby reducing the risk of memory exhaustion and denial of service. Ensure that any such network device is configured to handle HTTP/2 traffic appropriately and that its own security posture is robust.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
