CVE catalog

CVE-2026-71418

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs reta

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 25, 2026

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple crafted HTTP/2 DATA frames with the EndOfStream flag set. This causes the internal buffer to grow and reprocess prior contents, leading to quadratic CPU consumption. This can result in degraded packet processing, loss of monitoring visibility, or a denial of service (DoS) condition. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpesuricataNot reported8.0.6fixed
Debiansuricata131:7.0.10-1vulnerable
Debiansuricata131:7.0.10-1+deb13u1vulnerable
Debiansuricata131:7.0.10-1+deb13u2vulnerable
Debiansuricata131:7.0.10-1+deb13u3vulnerable
Debiansuricata131:7.0.10-1+deb13u4vulnerable
Debiansuricata131:7.0.11-1vulnerable
Debiansuricata131:7.0.11-1~bpo13+1vulnerable
Debiansuricata131:8.0.0-1~exp1vulnerable
Debiansuricata131:8.0.0-1~exp2vulnerable
Debiansuricata131:8.0.0-1~exp4vulnerable
Debiansuricata131:8.0.0-1~exp5vulnerable
Debiansuricata131:8.0.1-1vulnerable
Debiansuricata131:8.0.1-2vulnerable
Debiansuricata131:8.0.1-3vulnerable
Debiansuricata131:8.0.1-3~bpo13+1vulnerable
Debiansuricata131:8.0.2-1vulnerable
Debiansuricata131:8.0.2-1~bpo13+1vulnerable
Debiansuricata131:8.0.3-1vulnerable
Debiansuricata131:8.0.3-1~bpo13+1vulnerable
Debiansuricata131:8.0.3-2~exp1vulnerable
Debiansuricata131:8.0.4-1vulnerable
Debiansuricata131:8.0.4-1~bpo13+1vulnerable
Debiansuricata131:8.0.5-1vulnerable
Debiansuricata131:8.0.5-1~bpo13+1vulnerable
Debiansuricata131:8.0.6-1vulnerable
Debiansuricata131:8.0.6-1~bpo13+1vulnerable
Debiansuricata131:8.0.7-1vulnerable
Debiansuricata131:8.0.7-1~bpo13+1vulnerable
Debiansuricata131:8.0.7-2~exp1vulnerable
Debiansuricata141:7.0.10-1vulnerable
Debiansuricata141:7.0.11-1vulnerable
Debiansuricata141:7.0.11-1~bpo13+1vulnerable
Debiansuricata141:8.0.0-1~exp1vulnerable
Debiansuricata141:8.0.0-1~exp2vulnerable
Debiansuricata141:8.0.0-1~exp4vulnerable
Debiansuricata141:8.0.0-1~exp5vulnerable
Debiansuricata141:8.0.1-1vulnerable
Debiansuricata141:8.0.1-2vulnerable
Debiansuricata141:8.0.1-3vulnerable
Debiansuricata141:8.0.1-3~bpo13+1vulnerable
Debiansuricata141:8.0.2-1vulnerable
Debiansuricata141:8.0.2-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-1vulnerable
Debiansuricata141:8.0.3-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-2~exp1vulnerable
Debiansuricata141:8.0.4-1vulnerable
Debiansuricata141:8.0.4-1~bpo13+1vulnerable
Debiansuricata141:8.0.5-1vulnerable
Debiansuricata141:8.0.5-1~bpo13+1vulnerable
Debiansuricata141:8.0.6-1~bpo13+1vulnerable
Debiansuricata141:8.0.6-1fixed
Ubuntusuricata16.042.0.8-1build1vulnerable
Ubuntusuricata16.042.0.9-1vulnerable
Ubuntusuricata16.042.0.10-1vulnerable
Ubuntusuricata16.042.0.10-2vulnerable
Ubuntusuricata16.042.0.11-1vulnerable
Ubuntusuricata16.043.0-1vulnerable
Ubuntusuricata18.043.2-2ubuntu3vulnerable
Ubuntusuricata22.041:6.0.4-2vulnerable
Ubuntusuricata22.041:6.0.4-3vulnerable
Ubuntusuricata24.041:7.0.0-2vulnerable
Ubuntusuricata24.041:7.0.2-1vulnerable
Ubuntusuricata24.041:7.0.2-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build3vulnerable
Ubuntusuricata26.041:7.0.10-1vulnerable
Ubuntusuricata26.041:8.0.1-3build1vulnerable
Ubuntusuricata26.041:8.0.2-1vulnerable
Ubuntusuricata26.041:8.0.2-1build1vulnerable
Ubuntusuricata26.041:8.0.3-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpesuricatacpeNot reported8.0.6Not reportedNVD-CVE-2026-71418Not reported
Debiansuricatadeb141:8.0.6-1Not reportedDEBIAN-CVE-2026-71418Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [suricata]Affected
    Details (4)

    • 1:7.0.10-1+deb13u4 · amd64 · trixie

      Affected

      nvd · suricata · debian · 13

    • 1:7.0.10-1+deb13u4 · arm64 · trixie

      Affected

      nvd · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · amd64 · trixie-backports

      Affected

      nvd · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · arm64 · trixie-backports

      Affected

      nvd · suricata · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]