CVE-2026-63452: CWE-400: Uncontrolled Resource Consumption in OISF suricata
CVE-2026-63452 is a high-severity vulnerability in Suricata versions 8.0.0 through 8.0.5. It involves uncontrolled resource consumption due to the HTTP/1 parser not limiting the number of small brotli compression bombs in a single flow, despite limiting decompression work per transaction. This can cause expensive decompression processing repeatedly, leading to degraded packet processing and potential denial of service. The issue is fixed in Suricata version 8.0.6.
AI Analysis
Technical Summary
Suricata, a network IDS/IPS and monitoring engine, has a resource exhaustion vulnerability in its HTTP/1 parser from versions 8.0.0 to 8.0.5. While the parser limits decompression work per transaction, it does not limit how many small brotli compression bombs a single flow can submit when response-body-decompress-layer-limit is enabled. This results in repeated expensive decompression operations in the rust/htp component, degrading packet processing performance and potentially causing denial of service or loss of monitoring visibility. The vulnerability is addressed in version 8.0.6.
Potential Impact
An attacker can exploit this vulnerability to cause Suricata to perform excessive decompression work, degrading its packet processing capabilities. This may lead to denial of service conditions or loss of monitoring visibility, impacting network security monitoring and intrusion detection effectiveness. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in Suricata version 8.0.6. Users should upgrade to version 8.0.6 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
CVE-2026-63452: CWE-400: Uncontrolled Resource Consumption in OISF suricata
Description
CVE-2026-63452 is a high-severity vulnerability in Suricata versions 8.0.0 through 8.0.5. It involves uncontrolled resource consumption due to the HTTP/1 parser not limiting the number of small brotli compression bombs in a single flow, despite limiting decompression work per transaction. This can cause expensive decompression processing repeatedly, leading to degraded packet processing and potential denial of service. The issue is fixed in Suricata version 8.0.6.
CVSS v3.1
Score 7.5high
Affected software
OISF
suricata
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Suricata, a network IDS/IPS and monitoring engine, has a resource exhaustion vulnerability in its HTTP/1 parser from versions 8.0.0 to 8.0.5. While the parser limits decompression work per transaction, it does not limit how many small brotli compression bombs a single flow can submit when response-body-decompress-layer-limit is enabled. This results in repeated expensive decompression operations in the rust/htp component, degrading packet processing performance and potentially causing denial of service or loss of monitoring visibility. The vulnerability is addressed in version 8.0.6.
Potential Impact
An attacker can exploit this vulnerability to cause Suricata to perform excessive decompression work, degrading its packet processing capabilities. This may lead to denial of service conditions or loss of monitoring visibility, impacting network security monitoring and intrusion detection effectiveness. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in Suricata version 8.0.6. Users should upgrade to version 8.0.6 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-16T19:35:57.768Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad9fcb55bf5e2cf583e411
Added to database: 09/18/2026, 20:32:11 UTC
Last enriched: 09/18/2026, 20:46:29 UTC
Last updated: 09/18/2026, 20:46:29 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.