CVE-2026-22263

EUVD-2026-4771
Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.54%
Affected Products (NVD)
VendorProductVersion
oisfsuricata
8.0.0 ≤
𝑥
< 8.0.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
suricata
bullseye
1:6.0.1-3
fixed
bullseye (security)
1:6.0.1-3+deb11u1
fixed
forky
1:8.0.6-1
fixed
sid
1:8.0.6-1
fixed
trixie
1:7.0.10-1+deb13u4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
suricata
bionic
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
not-affected
xenial
ignored
Common Weakness Enumeration
References
https://github.com/OISF/suricata/commit/018a377f74e3eb2b042c6f783ad9043060923428
https://github.com/OISF/suricata/security/advisories/GHSA-rwc5-hxj6-hwx7
https://redmine.openinfosecfoundation.org/issues/8201