CVE-2026-45764

[CVE catalog]

Severity

Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Published

May 28, 2026, 12:00:00 AM UTC

Updated

Sep 10, 2026, 10:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A type confusion flaw was found in Suricata's HTTP/2 protocol parsing engine. When processing network traffic, Suricata fails to properly validate protocol state transitions during HTTP/2 frame handling. A remote, unauthenticated attacker could exploit this vulnerability by transmitting specially crafted HTTP/2 traffic through a network monitored by Suricata. Successful exploitation triggers an internal memory type confusion, causing the Suricata process to crash and resulting in a Denial of Service (DoS) for network intrusion detection and monitoring capabilities. Type confusion in Suricata's HTTP/2 protocol engine allows remote, unauthenticated attackers to send crafted HTTP/2 traffic, triggering an engine crash and inducing a denial-of-service condition. Default Red Hat network monitoring deployments processing untrusted HTTP/2 ingress traffic expose the daemon to crash vectors without proper input filtering or protocol parsing isolation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.