Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-31935: Suricata may exhaust memory when handling HTTP/2 frames
CVE-2026-31935 · published 7 months ago
Summary
If you run Suricata versions earlier than 7.0.15 or 8.0.4, a flood of specially crafted HTTP/2 continuation frames can fill up the program's memory and cause it to stop. This can interrupt network monitoring or intrusion detection. Upgrade Suricata to version 7.0.15 or newer (or 8.0.4 or newer) to prevent the problem.
What to do
- Update debian suricata to version 1:8.0.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | suricata | All versions |
| Debian:12 | debian | suricata | All versions |
| Debian:13 | debian | suricata | All versions |
| Debian:14 | debian | suricata |
< 1:8.0.4-1 Fix: upgrade to 1:8.0.4-1
|
| Ubuntu:16.04:LTS | canonical | suricata | All versions |
| – | oisf | suricata |
< 7.0.15 >= 8.0.0, < 8.0.4 cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* |
Original advisory text
Suricata http2: unbounded resource consumption
Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.
References
- https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x Vendor Advisory
- https://redmine.openinfosecfoundation.org/issues/8289 Issue Tracking Permissions Required
- https://security-tracker.debian.org/tracker/CVE-2026-31935 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-31935 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-31935 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31935... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-31935 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published2 Apr 2026
Updated30 Oct 2026
First seen2 Apr 2026
Sources
CVE-2026-31935 · NVD
DEBIAN-CVE-2026-31935 · OSV
UBUNTU-CVE-2026-31935 · OSV
CVE-2026-31935 · OSV
GHSA-vxrp-5pg7-7v4x · GHSA
Track software like this
Free during beta