Suricata, a network intrusion detection and prevention system, has a vulnerability (CVE-2026-71418) in its DNS-over-HTTP/2 processing implementation in rust/src/http2/http2.rs. From versions 8.0.0 up to but not including 8.0.6, the internal buffer used to process HTTP/2 DATA frames is retained instead of being cleared. When multiple DATA frames with the EndOfStream flag are received, the buffer can grow to its 65 KiB limit and cause all prior contents to be reprocessed repeatedly. This results in quadratic CPU complexity, which can degrade packet processing performance, cause loss of monitoring visibility, or lead to denial of service conditions. The vulnerability has been addressed and fixed in version 8.0.6.

The vulnerability causes a denial of service impact by degrading Suricata's packet processing capabilities due to inefficient handling of HTTP/2 DATA frames. This can result in loss of monitoring visibility and potentially disrupt network security monitoring operations. There is no impact on confidentiality or integrity reported.

Upgrade Suricata to version 8.0.6 or later, where this vulnerability has been fixed. No other mitigation is necessary as the issue is resolved in the official patch.