Allocation of Resources Without Limits or Throttling in Suricata - #VU162646
Published: November 9, 2026
Vulnerability identifier: #VU162646
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust Suricata sensor memory.
The vulnerability exists due to missing enforcement of the configured max-table-size limit when Suricata's HTTP/2 parser, enabled by default, processes an HPACK dynamic table size update. An unauthenticated remote attacker can send an oversized update followed by indexed headers across many flows, causing headers to remain allocated for each flow's lifetime with growth bounded only by stream.reassembly.depth.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7