CVE-2026-45759

Suricata, an open-source network IDS/IPS and network security monitoring engine, contains an uncontrolled resource consumption flaw (CWE-400): during HTTP response body processing it can repeatedly perform expensive parsing of very large HTTP `Content-Disposition` headers. An attacker able to send crafted HTTP traffic through or to a monitored link can trigger this repeatedly, causing excessive CPU usage on the inspection engine and a denial of service. The impact is availability-only (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/A:H); there is no confidentiality or integrity impact. Any organization running Suricata before 7.0.16 (7.0.x) or before 8.0.5 (8.0.x) that inspects HTTP traffic is affected. There is currently no known exploitation in the wild, no public proof-of-concept, and the issue is not on the CISA KEV list.

What to do: Upgrade Suricata to 7.0.16 on the 7.0.x branch or 8.0.5 on the 8.0.x branch. If upgrading is not immediately possible, deploy the documented bypass rule (alert http1 any any -> any any with http.request_header; content "Content-Disposition:"; startswith; bsize: > 8192; bypass;) to skip expensive parsing of oversized Content-Disposition headers. Audit whether your sensors inspect HTTP traffic on untrusted links, since only HTTP-inspecting deployments are exposed to this CPU-exhaustion vector.