An attacker who can send traffic to a Suricata engine can construct a flood of HTTP/2 continuation frames that cause the software to allocate more memory than intended. The unbounded consumption of resources eventually exhausts the system’s memory, causing the Suricata process to be terminated by the operating system. This vulnerability leads to a denial of service condition, interrupting network monitoring and intrusion detection functions.

The issue affects the Open Information Security Foundation’s Suricata network IDS, IPS, and NSM engine. Versions before 7.0.15 and before 8.0.4 are affected. Operators running those releases on any platform are at risk.

The CVSS score of 7.5 indicates a high risk, and while EPSS data is lacking, the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw can be triggered by crafted network traffic that a remote adversary can generate, the attack vector is likely remote, requiring no special privileges. The lack of a published exploit suggests exploitation may be low‑to‑moderate, but the potential for a simple, automated denial of service remains significant.