Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 parsing if it is not required.
Published: 2026-09-10
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

Suricata, a network intrusion detection and prevention engine, parses HTTP/2 traffic. In versions prior to 7.0.16 and 8.0.5, a protocol change during parsing can trigger type‑confusion (CWE‑843). Maliciously crafted HTTP/2 frames may cause Suricata to terminate, resulting in a denial of service for systems relying on the engine for monitoring.

Affected Systems

Suricata releases before 7.0.16 and before 8.0.5 are affected. All releases 7.0.16 and newer or 8.0.5 and newer contain the fix.

Risk and Exploitability

The CVSS base score of 9.1 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An external attacker can inject malicious HTTP/2 traffic into a running Suricata instance, triggering the type‑confusion and causing a crash. No publicly known exploitation activity is reported at this time.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Suricata to version 7.0.16 or 8.0.5, or any newer release that includes the fix.
  • If an upgrade cannot be performed immediately, disable HTTP/2 parsing in the Suricata configuration to prevent the vulnerability from being triggered.
  • As an additional precaution, block HTTP/2 traffic at the network perimeter so that malicious frames never reach the Suricata instance.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*

Wed, 16 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 11 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Oisf
Oisf suricata
Vendors & Products Oisf
Oisf suricata

Thu, 10 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 parsing if it is not required.
Title Suricata http2: protocol-change type confusion can lead to denial of service
Weaknesses CWE-843
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oisf Suricata
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-11T15:12:09.425Z

Reserved: 2026-05-13T07:45:21.250Z

Link: CVE-2026-45764

cve-icon Vulnrichment

Updated: 2026-09-11T15:12:06.152Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-10T22:16:56.250

Modified: 2026-09-16T20:17:56.497

Link: CVE-2026-45764

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-10T21:14:30Z

Links: CVE-2026-45764 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T07:30:09Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')