CVE-2026-31933

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31933", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.654Z", "datePublished": "2026-04-02T14:03:35.917Z", "dateUpdated": "2026-04-03T16:01:09.310Z"}, "containers": {"cna": {"title": "Suricata stream: quadratic complexity in stream inspection", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp"}, {"name": "https://redmine.openinfosecfoundation.org/issues/8272", "tags": ["x_refsource_MISC"], "url": "https://redmine.openinfosecfoundation.org/issues/8272"}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"version": "< 7.0.15", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T14:03:35.917Z"}, "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4."}], "source": {"advisory": "GHSA-hvp5-gpr6-j4gp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T16:00:34.285774Z", "id": "CVE-2026-31933", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:01:09.310Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31933", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T16:00:34.285774Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:00:59.307Z"}}], "cna": {"title": "Suricata stream: quadratic complexity in stream inspection", "source": {"advisory": "GHSA-hvp5-gpr6-j4gp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": "< 7.0.15"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.4"}]}], "references": [{"url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp", "name": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://redmine.openinfosecfoundation.org/issues/8272", "name": "https://redmine.openinfosecfoundation.org/issues/8272", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T14:03:35.917Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31933", "state": "PUBLISHED", "dateUpdated": "2026-04-03T16:01:09.310Z", "dateReserved": "2026-03-10T15:10:10.654Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T14:03:35.917Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "suricata", "vendor": "OISF", "versions": [{"status": "affected", "version": "< 7.0.15"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E0D4CF4-11E0-4FB1-9C17-F38257D376ED", "versionEndExcluding": "7.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "F35C5A48-CA30-43B3-9E53-D3E51C862604", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4."}, {"lang": "es", "value": "Suricata es un motor de IDS, IPS y NSM de red. Antes de las versiones 7.0.15 y 8.0.4, el tr\u00e1fico especialmente dise\u00f1ado puede hacer que Suricata se ralentice, afectando el rendimiento en modo IDS. Este problema ha sido parcheado en las versiones 7.0.15 y 8.0.4."}], "id": "CVE-2026-31933", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31933", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T16:00:34.285774Z", "version": "2.0.3"}}]}, "published": "2026-04-02T14:16:28.930", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://redmine.openinfosecfoundation.org/issues/8272"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Suricata: Suricata: Denial of Service due to specially crafted network traffic", "id": "2454375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454375"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. A remote attacker can exploit this vulnerability by sending specially crafted network traffic. This can cause Suricata to slow down significantly, leading to a denial of service (DoS) in IDS mode, which impacts the system's ability to detect and prevent threats."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-31933", "public_date": "2026-04-02T14:03:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31933\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31933\nhttps://github.com/OISF/suricata/security/advisories/GHSA-hvp5-gpr6-j4gp\nhttps://redmine.openinfosecfoundation.org/issues/8272"], "statement": "This is an Important denial of service vulnerability in Suricata, a network Intrusion Detection System (IDS). Specially crafted network traffic can cause Suricata to experience significant performance degradation when operating in IDS mode. This can impair the system's ability to effectively detect and prevent threats in Red Hat environments where Suricata is deployed.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "suricata", "source": "cna", "vendor": "OISF"}, "product": "suricata", "vendor": "oisf"}], "analysis": {"en": {"generated_at": "2026-04-07T23:34:51.614041+00:00", "value": {"mitigation_remediation": ["Upgrade Suricata to version 7.0.15 or later for the 7.x line, or to 8.0.4 or later for the 8.x line; this patch removes the quadratic complexity.", "Restart the Suricata service to load the updated binary.", "Verify that the running Suricata version matches the patched release by checking the version output or logs.", "Ensure that every node in your Suricata deployment is updated to the patched version to maintain consistent protection."], "summary": {"action": "Patch Update", "impact": "Denial of Service via performance degradation"}, "threat_synthesis": {"affected_systems": "All versions of OISF Suricata prior to 7.0.15 and 8.0.4 are affected. Users of the 7.x line must upgrade to 7.0.15 or later; users of the 8.x line must upgrade to 8.0.4 or later to receive the fix.", "description_and_impact": "Suricata, a network IDS, IPS and NSM engine, suffers from quadratic processing complexity in its stream inspection routine. When an attacker sends specially crafted traffic, the engine's packet handling slows dramatically, reducing throughput and potentially causing the IDS to fall behind legitimate traffic. This weakness corresponds to resource exhaustion and poor input handling, allowing an attacker to deplete processing resources.", "risk_and_exploitability": "The CVSS score is 7.5, indicating a high severity impact on availability. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved by an attacker who can inject crafted traffic into the network stream observed by Suricata. No special privileges or local access are required; the attack vector is a remote network-based injection. Successful exploitation results in degraded performance or a denial of service. No workaround is available beyond applying the patch."}}}}, "created": "2026-04-02T20:12:22.078311+00:00", "updated": "2026-04-08T19:56:23.651227+00:00", "vendors": ["oisf", "oisf$PRODUCT$suricata"]}