CVE-2026-31935

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-26)

CWEs

CWE-400, CWE-770

Published

2026-04-02

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• oisf:suricata

References

• https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x
• https://redmine.openinfosecfoundation.org/issues/8289

Check your stackJSON