CVE-2026-45764
Description
A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially crafted HTTP/2 traffic through a network monitored by Suricata. Successful exploitation triggers an internal memory type confusion, causing the Suricata process to crash and resulting in a Denial of Service (DoS) for network intrusion detection and monitoring capabilities.
Statement
Type confusion in Suricata's HTTP/2 protocol engine allows remote, unauthenticated attackers to send crafted HTTP/2 traffic, triggering an engine crash and inducing a denial-of-service condition. Default Red Hat network monitoring deployments processing untrusted HTTP/2 ingress traffic expose the daemon to crash vectors without proper input filtering or protocol parsing isolation.
Mitigation
Disable HTTP/2 parsing within the Suricata configuration file by setting the HTTP/2 protocol parser status to disabled if HTTP/2 inspection is not strictly required by the environment.
Understanding the Weakness (CWE)
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
