CVE-2026-46387

Suricata, an open-source network IDS/IPS and network security monitoring engine, mishandles highly compressed HTTP/2 response bodies (CWE-409, data amplification), allowing the decompressed response-body buffer to grow without an effective upper bound. A remote attacker whose traffic is inspected by a Suricata sensor can trigger the flaw by sending a crafted HTTP/2 DATA payload compressed with gzip, deflate, or brotli at a high compression ratio, which forces Suricata to allocate excessive memory while decompressing. There is no confidentiality or integrity impact; the attacker's gain is denial of service, via memory exhaustion that can degrade or crash the inspection host. Any deployment running Suricata versions prior to 7.0.16 or 8.0.5 that processes HTTP/2 web traffic is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation in the wild has been reported.

What to do: Upgrade Suricata to 7.0.16 on the 7.x series or 8.0.5 on the 8.x series. If upgrading is not immediately possible, apply the advisory workaround by disabling HTTP/2 parsing on sensors that inspect untrusted web traffic. Prioritize internet-facing and high-traffic inspection points, since the attack requires no authentication or user interaction and can be launched by any traffic crossing the monitored link.