The flaw is an infinite recursion triggered during HTTP decompression, causing a stack overflow that crashes Suricata. As the CVE description does not specify the exact input that triggers the recursion, it is inferred that malformed or specially crafted HTTP traffic could invoke the recursive decompression path, leading to an application crash and denial of service. The issue is rooted in unchecked recursion (CWE‑674) and memory overwrite (CWE‑787).

OISF Suricata network IDS/IPS versions 8.0.0 through 8.0.2. The problem exists in all builds covering the http1 module during decompression, and the fix was applied in release 8.0.3.

The CVSS rating of 7.5 indicates a high severity level for this vulnerability. The EPSS score of < 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The CVE statement does not detail the attack vector, so the specific conditions under which the recursion can be triggered remain unspecified.