CVE-2026-46387— Suricata http2: decompression bomb can cause denial of service in Suricata
Quick assessment
Affected
OISF suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 是一款集网络入侵检测系统、入侵防御系统和网络安全监控引擎于一体的安全工具。在 7.0.16 和 8.0.5 版本之前，Suricata 的 HTTP/2 解压缩处理路径中，解压缩后的响应体缓冲区可能在没有有效上限的情况下持续增长。攻击者可以利用精心构造的 HTTP/2 DATA 载荷（例如使用高压缩比的 gzip、deflate 或 brotli 压缩数据），导致 Suricata 在解压缩过程中分配过多的内存，从而引发内存耗尽问题。7.0.16 和 8.0.5 版本已修复此漏洞。作为临时应对措施
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-46387
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Suricata http2: decompression bomb can cause denial of service in Suricata
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-46387
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46387
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46387 (1)
Vendor Pages for CVE-2026-46387 (1)
Other References for CVE-2026-46387 (1)
-
🔗 Open Information Security Foundation x_refsource_MISC
Same Patch Batch · OISF · 2026-09-10 · 3 CVEs total
| CVE-2026-45747 | 7.5 HIGH | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-45763 | 5.9 MEDIUM | Suricata lua: sandbox allocation limit not enforced for new allocations |
IV. Related Vulnerabilities
Same product: suricata
-
CVE-2026-45747
Suricata lua/tls: null dereference in TlsGetCertInfo -
CVE-2026-45763
Suricata lua: sandbox allocation limit not enforced for new -
CVE-2026-31937
Suricata dcerpc: quadratic complexity in dcerpc buffering -
CVE-2026-31935
Suricata http2: unbounded resource consumption -
CVE-2026-31934
Suricata smtp/mine: quadratic complexity in extracting urls
Same vendor: OISF
-
CVE-2026-45747
Suricata lua/tls: null dereference in TlsGetCertInfo -
CVE-2026-45763
Suricata lua: sandbox allocation limit not enforced for new -
CVE-2026-31937
Suricata dcerpc: quadratic complexity in dcerpc buffering -
CVE-2026-31935
Suricata http2: unbounded resource consumption -
CVE-2026-31934
Suricata smtp/mine: quadratic complexity in extracting urls
Same weakness: CWE-409
-
CVE-2026-79695
Dell SCG 5.0 压缩数据放大导致远程拒绝服务 -
CVE-2026-69304
ASP.NET Core Denial of Service Vulnerability -
CVE-2026-85786
Incomplete fix for CVE-2026-75936 memory-amplification denia -
CVE-2026-82520
parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attach -
CVE-2026-84382
HTTPX2: Streaming response decompression does not bound peak
V. Comments for CVE-2026-46387
No comments yet