Failure to Handle Incomplete Element in Suricata - #VU162666
Published: November 9, 2026
Vulnerability identifier: #VU162666
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-239
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass Suricata's HTTP response body detection and related file processing.
The vulnerability exists due to incomplete handling of gzip FHCRC or FEXTRA length fields split across HTTP/1 chunked response boundaries during response decompression, which is enabled by default. An unauthenticated remote attacker can serve responses with fragmented gzip header fields that cause decompression to fail, leaving the body inspected as compressed data rather than decompressed content.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7