CVE-2026-31935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31935", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.654Z", "datePublished": "2026-04-02T14:36:44.186Z", "dateUpdated": "2026-04-02T18:42:31.423Z"}, "containers": {"cna": {"title": "Suricata http2: unbounded resource consumption", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x"}, {"name": "https://redmine.openinfosecfoundation.org/issues/8289", "tags": ["x_refsource_MISC"], "url": "https://redmine.openinfosecfoundation.org/issues/8289"}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"version": "< 7.0.15", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T14:36:44.186Z"}, "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4."}], "source": {"advisory": "GHSA-vxrp-5pg7-7v4x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T18:42:22.298340Z", "id": "CVE-2026-31935", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T18:42:31.423Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T18:42:22.298340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T18:42:27.210Z"}}], "cna": {"title": "Suricata http2: unbounded resource consumption", "source": {"advisory": "GHSA-vxrp-5pg7-7v4x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OISF", "product": "suricata", "versions": [{"status": "affected", "version": "< 7.0.15"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.4"}]}], "references": [{"url": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x", "name": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://redmine.openinfosecfoundation.org/issues/8289", "name": "https://redmine.openinfosecfoundation.org/issues/8289", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T14:36:44.186Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31935", "state": "PUBLISHED", "dateUpdated": "2026-04-02T18:42:31.423Z", "dateReserved": "2026-03-10T15:10:10.654Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T14:36:44.186Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "suricata", "vendor": "OISF", "versions": [{"status": "affected", "version": "< 7.0.15"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E0D4CF4-11E0-4FB1-9C17-F38257D376ED", "versionEndExcluding": "7.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "matchCriteriaId": "F35C5A48-CA30-43B3-9E53-D3E51C862604", "versionEndExcluding": "8.0.4", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4."}, {"lang": "es", "value": "Suricata es un motor IDS, IPS y NSM de red. Antes de las versiones 7.0.15 y 8.0.4, la inundaci\u00f3n de tramas de continuaci\u00f3n HTTP2 manipuladas puede provocar el agotamiento de la memoria, lo que normalmente resulta en el cierre del proceso de Suricata por parte del sistema operativo. Este problema ha sido parcheado en las versiones 7.0.15 y 8.0.4."}], "id": "CVE-2026-31935", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31935", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T18:42:22.298340Z", "version": "2.0.3"}}]}, "published": "2026-04-02T15:16:37.657", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://redmine.openinfosecfoundation.org/issues/8289"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Suricata: Suricata: Denial of Service via HTTP2 continuation frame flooding", "id": "2454366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454366"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Suricata. A remote attacker can exploit this vulnerability by sending a flood of crafted HTTP2 continuation frames. This can lead to memory exhaustion, causing the Suricata process to shut down, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, consider deploying Suricata behind a network firewall or load balancer capable of inspecting and rate-limiting HTTP/2 traffic. This can help prevent a flood of crafted HTTP/2 continuation frames from reaching the Suricata instance, thereby reducing the risk of memory exhaustion and denial of service. Ensure that any such network device is configured to handle HTTP/2 traffic appropriately and that its own security posture is robust."}, "name": "CVE-2026-31935", "public_date": "2026-04-02T14:36:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31935\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31935\nhttps://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x\nhttps://redmine.openinfosecfoundation.org/issues/8289"], "statement": "Important: A flaw in Suricata allows a remote attacker to trigger a Denial of Service. By sending a flood of specially crafted HTTP2 continuation frames, an attacker can cause memory exhaustion, leading to the Suricata process shutting down. This vulnerability affects Suricata deployments configured to inspect HTTP2 traffic.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "suricata", "source": "cna", "vendor": "OISF"}, "product": "suricata", "vendor": "oisf"}], "analysis": {"en": {"generated_at": "2026-04-07T23:55:08.965909+00:00", "value": {"mitigation_remediation": ["Update Suricata to version 7.0.15 or later, or to 8.0.4 or later if running an 8.x release."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The impacted vendor is the Open Information Security Foundation, whose Suricata network IDS, IPS, and NSM product is affected. All releases preceding version 7.0.15 and 8.0.4 are vulnerable; deployments running these unpatched builds are at risk during HTTP/2 traffic analysis.", "description_and_impact": "Suricata versions before 7.0.15 and 8.0.4 are vulnerable to an unbounded resource consumption flaw that can be triggered by flooding the engine with crafted HTTP/2 continuation frames. When these frames are processed, the software allocates memory without proper bounds checks, eventually exhausting available heap space. This shortage usually causes the operating system to kill the Suricata process, resulting in a loss of network monitoring and intrusion detection capabilities. The weakness maps to CWE\u2011400 (Uncontrolled Resource Consumption) and CWE\u2011770 (Allocation of Resources on Demand).", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity. The EPSS score is below 1\u202f%, implying that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to a Suricata instance and would send a crafted stream of HTTP/2 continuation frames to trigger the memory exhaustion. Successful exploitation results in service interruption rather than code execution."}}}}, "created": "2026-04-02T20:12:17.288458+00:00", "updated": "2026-04-08T19:56:21.353797+00:00", "vendors": ["oisf", "oisf$PRODUCT$suricata"]}