CVE-2026-22263

EUVD-2026-4771
Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub_MCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Affected Products (NVD)
VendorProductVersion
oisfsuricata
8.0.0 ≤
𝑥
< 8.0.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
suricata
bookworm
1:6.0.10-1
not-affected
bullseye
1:6.0.1-3
not-affected
bullseye (security)
1:6.0.1-3+deb11u1
fixed
forky
1:8.0.3-1
fixed
sid
1:8.0.3-1
fixed
trixie
1:7.0.10-1+deb13u2
not-affected
Common Weakness Enumeration
References
https://github.com/OISF/suricata/commit/018a377f74e3eb2b042c6f783ad9043060923428
https://github.com/OISF/suricata/security/advisories/GHSA-rwc5-hxj6-hwx7
https://redmine.openinfosecfoundation.org/issues/8201