CVE-2026-46387 OISF CVE debrief

Who should care

Network security teams and administrators using Suricata for network security monitoring should assess their exposure and prioritize patching or mitigating this vulnerability. Affected operators and platforms require review of vulnerability management and security team impact. This vulnerability may impact network security monitoring capabilities and require additional monitoring and review.

Why it matters

This vulnerability in Suricata's HTTP/2 decompression path could lead to excessive memory allocation, potentially causing a denial-of-service condition. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Suricata is used for network security monitoring.

• Potential denial-of-service condition due to excessive memory allocation
• Need to verify affected versions and patch or mitigate the vulnerability
• Possible impact on network security monitoring capabilities
• Requirement to monitor Suricata logs for potential exploitation attempts

Technical summary

The vulnerability is caused by the lack of an effective upper bound in Suricata's HTTP/2 decompression path, allowing for excessive memory allocation when handling crafted HTTP/2 DATA payloads with high compression ratios. This issue affects Suricata versions prior to 7.0.16 and 8.0.5, potentially causing a denial-of-service condition. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Suricata is used for network security monitoring. The decompression path grows without an effective upper bound when handling crafted HTTP/2 DATA payloads with high compression ratios.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Suricata is used for network security monitoring.

Recommended defensive actions

• Patch Suricata to version 7.0.16 or 8.0.5
• Disable HTTP2 as a workaround
• Monitor Suricata logs for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The Suricata project has released versions 7.0.16 and 8.0.5 to address this issue. Defenders should verify affected scope, review official advisories, and monitor for potential exploitation attempts. Evidence is limited, and further verification is required to assess exposure and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.