Suricata versions before 7.0.15 and 8.0.4 are vulnerable to an unbounded resource consumption flaw that can be triggered by flooding the engine with crafted HTTP/2 continuation frames. When these frames are processed, the software allocates memory without proper bounds checks, eventually exhausting available heap space. This shortage usually causes the operating system to kill the Suricata process, resulting in a loss of network monitoring and intrusion detection capabilities. The weakness maps to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Allocation of Resources on Demand).

The impacted vendor is the Open Information Security Foundation, whose Suricata network IDS, IPS, and NSM product is affected. All releases preceding version 7.0.15 and 8.0.4 are vulnerable; deployments running these unpatched builds are at risk during HTTP/2 traffic analysis.

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1 %, implying that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to a Suricata instance and would send a crafted stream of HTTP/2 continuation frames to trigger the memory exhaustion. Successful exploitation results in service interruption rather than code execution.