CVE-2026-22263

EUVD-2026-4771
Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
oisfsuricata
8.0.0 ≤
𝑥
< 8.0.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
suricata
bookworm
1:6.0.10-1
fixed
bullseye
1:6.0.1-3
fixed
bullseye (security)
1:6.0.1-3+deb11u1
fixed
forky
1:8.0.4-1
fixed
sid
1:8.0.4-1
fixed
trixie
1:7.0.10-1+deb13u3
fixed
Common Weakness Enumeration
References
https://github.com/OISF/suricata/commit/018a377f74e3eb2b042c6f783ad9043060923428
https://github.com/OISF/suricata/security/advisories/GHSA-rwc5-hxj6-hwx7
https://redmine.openinfosecfoundation.org/issues/8201