CVE-2026-71418
Description
A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple crafted HTTP/2 DATA frames with the EndOfStream flag set. This causes the internal buffer to grow and reprocess prior contents, leading to quadratic CPU consumption. This can result in degraded packet processing, loss of monitoring visibility, or a denial of service (DoS) condition.
Statement
This flaw is rated with an Important severity because an unauthenticated remote attacker can trigger significant CPU consumption leading to denial of service without requiring user interaction or specialized privileges. Suricata is not shipped within core Red Hat Enterprise Linux repositories and is only available through Extra Packages for Enterprise Linux (EPEL). Red Hat Enterprise Linux environments that do not utilize packages from EPEL are not exposed to this vulnerability.
Mitigation
To reduce the attack surface, consider implementing network filtering rules to block or restrict DNS-over-HTTP/2 traffic from reaching Suricata instances if this protocol is not explicitly required for monitoring. This operational control can prevent the processing of malicious HTTP/2 DATA frames that trigger the vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
