CVE-2026-71418: Suricata DNS-over-HTTP/2 DOS Vulnerability

CVE-2026-71418 Overview

CVE-2026-71418 is a denial-of-service vulnerability in Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw affects DNS-over-HTTP/2 (DoH/2) processing in rust/src/http2/http2.rs across Suricata versions 8.0.0 through 8.0.5. The parser retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer between frames. Attackers can send multiple DATA frames with the EndOfStream flag set to trigger quadratic CPU complexity and exhaust monitoring resources. The issue is fixed in Suricata 8.0.6.

Critical Impact

Remote unauthenticated attackers can degrade packet processing, cause loss of monitoring visibility, and induce denial of service on Suricata sensors handling DoH/2 traffic.

Affected Products

• Suricata 8.0.0 through 8.0.5
• Deployments processing DNS-over-HTTP/2 traffic
• Suricata IDS/IPS sensors monitoring HTTP/2 flows

Discovery Timeline

• 2026-09-18 - CVE-2026-71418 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-71418

Vulnerability Analysis

The vulnerability resides in Suricata's DoH/2 application-layer parser implemented in rust/src/http2/http2.rs. When Suricata processes HTTP/2 DATA frames carrying DNS-over-HTTP/2 payloads, the internal buffer doh.data_buf[dir.index()] accumulates frame contents without being cleared after each processed frame. Repeated frames with EndOfStream set cause the buffer to grow toward its 65 KiB limit while re-processing all previously appended content. This produces algorithmic complexity approaching O(n²) in CPU cost per stream, classified under [CWE-407: Inefficient Algorithmic Complexity]. On sensors monitoring high-volume DoH/2 traffic, the compounded parsing cost degrades packet processing throughput and can drop flows entirely.

Root Cause

The root cause is a missing buffer reset after the DoH/2 handler processes a complete stream unit. The fix adds an explicit doh.data_buf[dir.index()].clear() call so subsequent DATA frames begin parsing against an empty buffer rather than the accumulated history.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP/2 traffic that Suricata classifies as DoH/2. By transmitting multiple DATA frames, each with the EndOfStream flag set, the attacker forces Suricata to reprocess growing buffer contents on every frame. No authentication or user interaction is required, and the attack traverses the network to reach any sensor performing HTTP/2 inspection.

// Patch: rust/src/http2/http2.rs - doh2: clear the buffer after processing it
                        SCAppLayerForceProtocolChange(flow, ALPROTO_DOH2);
                    }
                }
+                doh.data_buf[dir.index()].clear();
            }
        }
    }
// Source: https://github.com/OISF/suricata/commit/1731805967edf5d31448db2ae43cf72c6cf46c11

Detection Methods for CVE-2026-71418

Indicators of Compromise

• Sudden CPU saturation on Suricata worker threads processing HTTP/2 or DoH/2 flows.
• Increasing app_layer.error.doh2 or HTTP/2 parser statistics in stats.log or eve.json.
• Packet drops and capture loss counters rising on interfaces that previously operated within budget.
• HTTP/2 streams containing repeated DATA frames with END_STREAM set from a single client.

Detection Strategies

• Monitor Suricata's internal telemetry for abrupt increases in per-flow parsing time on ALPROTO_DOH2 traffic.
• Alert on flow records where the same 5-tuple issues multiple DATA frames with END_STREAM in rapid succession.
• Baseline DoH/2 endpoint volumes and flag statistical outliers in bytes-per-flow or frames-per-stream.

Monitoring Recommendations

• Ingest Suricata stats.log and eve.json into a centralized SIEM to correlate sensor performance with traffic patterns.
• Track kernel packet drop counters and NIC RX queue overflow alongside Suricata capture statistics.
• Enable health checks that trigger on sustained worker CPU above baseline thresholds.

How to Mitigate CVE-2026-71418

Immediate Actions Required

• Upgrade Suricata to version 8.0.6 or later on all affected sensors.
• Inventory sensors running versions 8.0.0 through 8.0.5 and prioritize those exposed to internet-facing HTTP/2 traffic.
• Review sensor capacity and packet loss metrics to identify potential prior exploitation.

Patch Information

The fix is available in Suricata 8.0.6. The patch clears the DoH/2 data buffer after processing, preventing accumulation across frames. Reference the GitHub Security Advisory GHSA-xjgq-3qw4-jp5f, the Suricata 8.0.6 Release, and the upstream commits 1731805967 and 26c26dea84 for implementation details.

Workarounds

• Disable DoH/2 application-layer parsing in suricata.yaml under app-layer.protocols.doh2 if upgrading is not immediately feasible.
• Restrict HTTP/2 inspection on sensors that do not require DoH/2 visibility.
• Deploy upstream rate limiting or ACLs to reduce exposure of sensors to untrusted HTTP/2 sources.

# Configuration example: disable DoH/2 parsing in suricata.yaml
app-layer:
  protocols:
    doh2:
      enabled: no

# Verify installed version after upgrade
suricata --build-info | grep -i version
suricata -V   # expect: This is Suricata version 8.0.6 or later