7.5

CVE-2026-63452

Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oisf ≫ Suricata Version >= 8.0.0 < 8.0.6
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.299
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
Release Notes
https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84
Vendor Advisory
Mitigation
https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f
Patch
https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88
Patch
https://redmine.openinfosecfoundation.org/issues/8694
Permissions Required