CVE-2026-63452
Description
A flaw was found in Suricata, a network Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). A remote attacker can exploit this vulnerability by sending repeated, small Brotli compressed responses to the HTTP/1 parser. This can cause the system to perform expensive decompression work, leading to excessive CPU consumption. The consequence is degraded packet processing, which may result in a denial of service or loss of network monitoring visibility.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, disable the `response-body-decompress-layer-limit` option in your Suricata configuration. This will prevent the engine from performing expensive decompression work on repeated Brotli compressed responses, thereby avoiding the denial of service. Disabling this feature may affect Suricata's ability to inspect compressed HTTP response bodies. A restart of the Suricata service is required for the configuration change to take effect.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
