Vulnerabilities

Suricata, the open-source network Intrusion Detection/Prevention and Network Security Monitoring engine, contains a type confusion flaw (CWE-843) in its HTTP/2 handling that occurs when a protocol change is processed during traffic inspection. An attacker who can send crafted HTTP/2 traffic across a link monitored by Suricata can trigger the flaw without authentication or user interaction, crashing the engine and causing denial of service. The CVSS 9.1 (critical) rating reflects high integrity and availability impact with no confidentiality loss, and the crash risk is especially serious for inline IPS deployments where sensor failure disrupts inspection. All Suricata versions prior to 7.0.16 (7.0.x branch) and prior to 8.0.5 (8.0.x branch) are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.

Do: Upgrade Suricata to 7.0.16 (7.0.x branch) or 8.0.5 (8.0.x branch), including patched builds supplied by appliance or distribution vendors that bundle the engine. If upgrading is not immediately possible, disable HTTP/2 parsing where it is not required, as this is the documented workaround. Prioritize inline IPS deployments, where a crash from crafted HTTP/2 traffic has the greatest operational impact.