CVE catalog

CVE-2026-31935

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 27, 2026

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpesuricataNot reported7.0.15fixed
CpesuricataNot reported8.0.4fixed
Debiansuricata131:7.0.10-1vulnerable
Debiansuricata131:7.0.10-1+deb13u1vulnerable
Debiansuricata131:7.0.10-1+deb13u2vulnerable
Debiansuricata131:7.0.10-1+deb13u3vulnerable
Debiansuricata131:7.0.10-1+deb13u4fixed
Debiansuricata141:7.0.10-1vulnerable
Debiansuricata141:7.0.11-1vulnerable
Debiansuricata141:7.0.11-1~bpo13+1vulnerable
Debiansuricata141:8.0.0-1~exp1vulnerable
Debiansuricata141:8.0.0-1~exp2vulnerable
Debiansuricata141:8.0.0-1~exp4vulnerable
Debiansuricata141:8.0.0-1~exp5vulnerable
Debiansuricata141:8.0.1-1vulnerable
Debiansuricata141:8.0.1-2vulnerable
Debiansuricata141:8.0.1-3vulnerable
Debiansuricata141:8.0.1-3~bpo13+1vulnerable
Debiansuricata141:8.0.2-1vulnerable
Debiansuricata141:8.0.2-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-1vulnerable
Debiansuricata141:8.0.3-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-2~exp1vulnerable
Debiansuricata141:8.0.4-1~bpo13+1vulnerable
Debiansuricata141:8.0.4-1fixed
CpesuricataNot reported8.0.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpesuricatacpeNot reported7.0.15Not reportedNot reportedNot reported
CpesuricatacpeNot reported8.0.4Not reportedNot reportedNot reported
Debiansuricatadeb131:7.0.10-1+deb13u4Not reportedDEBIAN-CVE-2026-31935Not reported
Debiansuricatadeb141:8.0.4-1Not reportedDEBIAN-CVE-2026-31935Not reported
CpesuricatacpeNot reported8.0.4Not reportedNVD-CVE-2026-31935Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [suricata]Fixed
    Details (4)

    • 1:7.0.10-1+deb13u4 · amd64 · trixie

      Fixed · Fixed: 1:7.0.10-1+deb13u4

      nvd · suricata · debian · 13

    • 1:7.0.10-1+deb13u4 · arm64 · trixie

      Fixed · Fixed: 1:7.0.10-1+deb13u4

      nvd · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1:7.0.10-1+deb13u4

      nvd · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1:7.0.10-1+deb13u4

      nvd · suricata · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]