CVE-2026-31935: Suricata HTTP2 DoS Vulnerability

CVE-2026-31935 Overview

CVE-2026-31935 is a Denial of Service vulnerability affecting Suricata, a widely-deployed open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. The vulnerability exists in the HTTP/2 protocol handling code, where flooding crafted HTTP/2 continuation frames can lead to memory exhaustion, typically resulting in the Suricata process being terminated by the operating system.

Critical Impact

Attackers can remotely crash Suricata instances by sending specially crafted HTTP/2 continuation frames, potentially leaving networks unprotected and enabling subsequent attacks to go undetected.

Affected Products

• Suricata versions prior to 7.0.15
• Suricata versions prior to 8.0.4

Discovery Timeline

• April 2, 2026 - CVE-2026-31935 published to NVD
• April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31935

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a category of weaknesses where the software does not properly limit the consumption of resources such as memory. In this case, the Suricata engine fails to adequately control memory allocation when processing HTTP/2 continuation frames.

HTTP/2 continuation frames are designed to allow HTTP header fields that exceed the maximum frame size to be split across multiple frames. When an attacker sends a flood of maliciously crafted continuation frames, Suricata allocates memory for each incoming frame without proper bounds checking or resource limiting. This leads to progressive memory exhaustion until the operating system's out-of-memory (OOM) killer terminates the Suricata process.

The network attack vector allows remote exploitation without authentication or user interaction. An attacker with network access to monitored traffic or the ability to inject traffic can trigger this condition. The impact is limited to availability—there is no confidentiality or integrity breach—but the consequences can be severe for organizations relying on Suricata for network security monitoring and intrusion prevention.

Root Cause

The root cause lies in insufficient resource management within Suricata's HTTP/2 protocol parser. The continuation frame handler does not enforce appropriate limits on the number of continuation frames that can be processed or the total memory that can be allocated for reassembling fragmented headers. This allows an attacker to exhaust available memory through sustained delivery of continuation frames.

Attack Vector

The attack can be executed remotely over the network by any entity capable of sending HTTP/2 traffic through a network segment monitored by Suricata. The attacker initiates an HTTP/2 connection and sends a stream of continuation frames designed to maximize memory allocation. Since no authentication or privileges are required, and no user interaction is necessary, the attack surface is broad. The vulnerability is particularly concerning in environments where Suricata operates inline as an IPS, as a crash could temporarily disable network protection capabilities.

For technical details about this vulnerability, refer to the GitHub Security Advisory and the Open Information Security Foundation issue tracker.

Detection Methods for CVE-2026-31935

Indicators of Compromise

• Sudden memory usage spikes on systems running Suricata, particularly correlating with HTTP/2 traffic
• Suricata process terminations logged by the operating system's OOM killer in /var/log/kern.log or system journal
• Gaps in network security monitoring data indicating periods when Suricata was unavailable
• Unusual volumes of HTTP/2 continuation frames from specific source IP addresses

Detection Strategies

• Monitor Suricata process health and memory consumption using system monitoring tools such as Prometheus, Grafana, or Nagios
• Configure alerts for abnormal memory growth patterns in the Suricata process
• Implement network flow analysis to identify anomalous HTTP/2 traffic patterns, particularly excessive continuation frames
• Review Suricata logs for parser errors or warnings related to HTTP/2 processing

Monitoring Recommendations

• Deploy SentinelOne Singularity™ to monitor endpoint and network infrastructure for signs of resource exhaustion attacks
• Establish baseline memory consumption metrics for Suricata instances and alert on significant deviations
• Enable detailed HTTP/2 logging where feasible to capture evidence of exploitation attempts
• Implement automated restart mechanisms for Suricata with alerting to ensure rapid recovery and incident awareness

How to Mitigate CVE-2026-31935

Immediate Actions Required

• Upgrade Suricata to version 7.0.15 or 8.0.4 (or later) immediately
• Monitor Suricata instances for signs of resource exhaustion until patches can be applied
• Consider temporarily disabling HTTP/2 inspection if upgrading is not immediately feasible and risk tolerance allows
• Review network architecture to ensure redundancy in security monitoring capabilities

Patch Information

The Open Information Security Foundation (OISF) has released patched versions that address this vulnerability. Upgrade to Suricata 7.0.15 for the 7.x branch or 8.0.4 for the 8.x branch. Detailed patch information is available in the GitHub Security Advisory and the OISF issue tracker.

Workarounds

• If immediate patching is not possible, consider disabling HTTP/2 protocol inspection in Suricata configuration as a temporary measure
• Implement rate limiting for HTTP/2 traffic at the network perimeter to reduce the effectiveness of flooding attacks
• Deploy additional monitoring to detect and alert on Suricata process crashes or memory exhaustion events
• Use network segmentation to limit attacker access to systems monitored by vulnerable Suricata instances

# Example: Upgrade Suricata on Debian/Ubuntu systems
sudo apt update
sudo apt install suricata

# Verify the installed version
suricata --build-info | grep -i version

# Restart Suricata service after upgrade
sudo systemctl restart suricata

# Verify Suricata is running
sudo systemctl status suricata