Suricata before 8.0.8 fixes multiple high-severity denial-of-service flaws
Original title: Multiple vulnerabilities in Suricata before 8.0.8
Listed issues cover CPU and memory exhaustion and a crash in TFTP, SIP, HTTP/2 and DoH2.
Victor Julien announced Suricata 8.0.8, which addresses several vulnerabilities rated HIGH. Named issues include unbounded TFTP transaction retention that can exhaust CPU, quadratic SIP TCP header processing, HTTP/2 Brotli decoding that can exhaust memory, and a DoH2 xbits track-tx type confusion that can crash Suricata. The feed text cuts off during a further HTTP/2 header-inspection issue.
Unconfirmed: The post is cut off, so issues after the HTTP/2 header-inspection item are not visible.
- Suricata 8.0.8 is the release that addresses the issues.
- TFTP issue #9085 can exhaust CPU through unbounded transaction retention.
- SIP issue #9101 has quadratic complexity in TCP header processing.
- HTTP/2 Brotli decoders can exhaust memory; DoH2 type confusion can crash Suricata.
Impact: CPU or memory exhaustion, or a Suricata crash
| Product | Affected | Fixed in |
|---|---|---|
| Suricata | before 8.0.8 | 8.0.8 |
- 1.Upgrade Suricata to 8.0.8.
From the original article
Posted by Victor Julien on Oct 29 Suricata 8. 0. 8 was released addressing a number of vulnerabilities.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.