CVE-2026-22260: 
Suricata vulnerability analysis and mitigation

CVE-2026-22260 is a stack overflow vulnerability caused by poorly bounded (uncontrolled) recursion in Suricata's HTTP/1 decompression logic. It affects Suricata versions 8.0.0 through 8.0.2 (prior to 8.0.3), a widely deployed open-source network IDS, IPS, and NSM engine maintained by OISF. The vulnerability was disclosed on January 27, 2026, and patched in version 8.0.3. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) in the InnerDecompressor::write() function within Suricata's Rust-based HTTP library (rust/htp/src/decompressors.rs). When processing HTTP request or response bodies with non-default request-body-limit or response-body-limit values, the decompressor could enter recursive self-calls — specifically when a WriteZero error triggered a buffer flush followed by a recursive self.write(data) call, and when decompression restarts were attempted — leading to unbounded stack growth and a crash. The fix replaced the recursive logic with an iterative loop. The vulnerability was discovered via oss-fuzz and is also classified as CWE-787 (Out-of-bounds Write) due to the stack overflow nature of the crash (GitHub Advisory, Patch Commit).

Successful exploitation causes Suricata to crash with a stack overflow, resulting in a complete denial of service of the IDS/IPS/NSM engine. Since Suricata is a network security monitoring component, its crash eliminates network visibility and threat detection capabilities for the duration of the outage. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. The attack requires no authentication, no user interaction, and is exploitable remotely over the network (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is only triggerable when request-body-limit or response-body-limit are set to non-default values in the Suricata configuration, which limits the exposed attack surface. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify network segments monitored by Suricata 8.0.0–8.0.2 instances configured with non-default request-body-limit or response-body-limit values.
2. Craft malicious HTTP traffic: Generate HTTP requests or responses with compressed bodies (e.g., gzip or deflate encoded) designed to trigger repeated WriteZero errors or decompression restart cycles in Suricata's HTTP parser.
3. Send traffic through monitored network: Transmit the crafted HTTP traffic across the network segment being monitored by the vulnerable Suricata instance, causing the decompressor's recursive write() calls to exhaust the stack.
4. Trigger crash: The unbounded recursion causes a stack overflow, crashing the Suricata process and disabling IDS/IPS/NSM capabilities on the affected segment (GitHub Advisory, Patch Commit).

• Process: Unexpected termination of the suricata process; crash dumps or core files generated by the Suricata service user.
• Logs: Suricata engine logs showing stack overflow errors or segmentation faults; system logs (/var/log/syslog, journalctl) recording Suricata process crashes.
• Network: Repeated HTTP traffic with compressed bodies (Content-Encoding: gzip/deflate) targeting the monitored network segment, particularly with unusual or malformed compression streams.
• File System: Presence of core dump files (e.g., core.*) in the Suricata working directory or system core dump location following unexpected process termination.

Upgrade Suricata to version 8.0.3 or later, which replaces the recursive decompression logic with an iterative loop, fully resolving the vulnerability (GitHub Advisory, Patch Commit). As an immediate workaround for deployments that cannot upgrade, set request-body-limit and response-body-limit to their default values in the Suricata configuration file, which prevents the vulnerable code path from being triggered (Red Hat Bugzilla).

The vulnerability was credited to oss-fuzz, Google's continuous fuzzing infrastructure for open-source projects, highlighting the value of automated fuzzing in security research (GitHub Advisory). The Suricata community announced the 8.0.3 release addressing this and other issues via the official Suricata forum. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.