Suricata: 19 Vulnerabilities Disclosed Together, Critical Flaws in HTTP/2 and DoH2 Parsers
Oisf Suricata: 19 vulnerabilities disclosed together, impacting HTTP/2, DoH2, FTP, and other protocols, with critical memory corruption flaws.
Key findings
- 19 vulnerabilities disclosed for Oisf Suricata between Sep 18-20, 2026, affecting multiple network protocols.
- Critical flaws (CVSSv3 9.4) include use-after-free and type confusion in HTTP/2 and DoH2 parsers.
- High-severity issues (CVSSv3 7.0-7.5) involve memory retention, decompression bombs, and Windows service path issues.
- Medium and low-severity bugs affect flow hashing, FTP, SIP, SMTP, DHCP, and SWF decompression.
- Most issues fixed in Suricata 7.0.17 and 8.0.6/8.0.7; users urged to update immediately.
On September 18-20, 2026, a significant batch of 19 vulnerabilities was disclosed for the Oisf Suricata network intrusion detection system. The vulnerabilities, spanning critical to low severity, primarily affect Suricata versions prior to 8.0.7 and 7.0.17, with many issues fixed in 8.0.6. The disclosures highlight several weaknesses in Suricata's handling of various network protocols, including HTTP/2, DoH2, FTP, SMTP, MQTT, and DHCP, as well as flaws in its flow hashing and rule prefiltering mechanisms. These vulnerabilities could potentially lead to denial-of-service conditions, information disclosure, or even remote code execution in certain configurations.
Several critical and high-severity vulnerabilities were disclosed, focusing on memory corruption and resource exhaustion. CVE-2026-94084 and CVE-2026-94083, both rated Critical (CVSSv3 9.4), involve use-after-free and type confusion bugs in the HTTP/2 and DoH2 parsers, respectively. These issues arise when transactions are inspected by specific rules or when there's an HTTP1 to HTTP2 upgrade in DoH2 requests, potentially leading to crashes.
High-severity flaws (CVSSv3 7.5) include CVE-2026-71418, a bug in DNS-over-HTTP/2 processing where frame contents are retained instead of cleared, and CVE-2026-63452, which involves an HTTP/1 parser's insufficient limitation on brotli compression bombs. CVE-2026-63447, affecting the FTP parser, allows continued transaction allocation beyond a configured limit, and CVE-2026-63446 points to an issue in AppLayerParserSetTransactionInspectId where only already-inspected transactions are marked as such, potentially bypassing inspection on flows passed by a rule. CVE-2026-57227, a medium-high severity bug (CVSSv3 8.2), involves an SMTP MIME quoted-printable decoder reading past a heap buffer. CVE-2026-57223, rated High (CVSSv3 7.0), concerns the Windows service installation logic potentially passing an unquoted service ImagePath, which could be exploited if Suricata is installed in a specific directory structure.
Medium-severity vulnerabilities (CVSSv3 5.3 to 6.5) include CVE-2026-71855 and CVE-2026-57222, both related to improper flow hashing where IPv4 and IPv6 flows might be treated as equal without proper family comparison. CVE-2026-63449, affecting the SMB parser, can retain force-completed transactions on certain flows. CVE-2026-57229, in the SMTP MIME parser, fails to fully reset state during Content-Type: message/rfc822 encapsulation. CVE-2026-57224, concerning the DHCP parser, creates stateless transactions without recording packet direction, impacting sensors observing only one direction of traffic.
Several low-severity vulnerabilities (CVSSv3 3.3 to 3.7) were also disclosed. CVE-2026-63451 involves a detection engine prefilter issue with specific rule combinations. CVE-2026-63450, in the FTP parser, treats certain command sequences as fatal errors instead of recoverable protocol events. CVE-2026-63449, in the SIP parser, uses 16-bit fields for body lengths, potentially truncating lengths for bodies exceeding 65,536 bytes. CVE-2026-57225 relates to JSON/NDJSON dataset value key resolution, assuming string values where others might exist. CVE-2026-57226 involves HTTP SWF decompression with an unsafe depth setting.
The majority of these vulnerabilities have been addressed in Suricata versions 7.0.17 and 8.0.6, with the most critical issues resolved in 8.0.7. Users are strongly advised to update to the patched versions to mitigate these risks. The broad range of affected protocols and components underscores the importance of keeping Suricata updated, especially for organizations relying on it for network security monitoring and intrusion prevention.
The timely disclosure and patching of these vulnerabilities by the Oisf team demonstrate a commitment to maintaining the security of the Suricata engine. Users should review their configurations and ensure they are running the latest stable versions to benefit from these security enhancements. The sheer number of disclosed issues in this batch highlights the complexity of deep packet inspection engines and the continuous effort required to secure them.