CVE-2026-22263: 
Suricata vulnerability analysis and mitigation

CVE-2026-22263 is a denial-of-service vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine, caused by quadratic complexity in HTTP/1 headers parsing across multiple packets. It affects Suricata versions 8.0.0 through 8.0.2 and was patched in version 8.0.3. The vulnerability was published on January 27, 2026, and was discovered via oss-fuzz. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1050 (Excessive Platform Resource Consumption within a Loop). Suricata's HTTP/1 header parser processes folded header lines in a loop; when each new network packet restarts header parsing and appends a new folded line, the cumulative work grows quadratically relative to the number of packets, causing significant CPU slowdown. The fix, applied in commit 018a377, introduces a constant MAX_NB_FOLD = 128 that limits the number of folded lines processed per header value, bounding the quadratic complexity. No authentication or user interaction is required to trigger the issue — an attacker only needs network access to send crafted multi-packet HTTP traffic to a monitored network segment (GitHub Commit, GitHub Advisory).

Successful exploitation degrades the availability of the Suricata IDS/IPS engine, potentially rendering network security monitoring and intrusion prevention capabilities severely impaired or unavailable during an attack. There is no confidentiality or integrity impact — the vulnerability is limited to a low availability impact. However, because Suricata serves as a critical network security control, its degradation could allow other malicious traffic to pass undetected during the attack window (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability was originally discovered by oss-fuzz, suggesting it was identified through automated fuzzing rather than adversarial research (GitHub Advisory, Feedly).

1. Reconnaissance: Identify network segments monitored by Suricata 8.0.0–8.0.2 deployments operating in IDS or IPS mode.
2. Craft malicious HTTP/1 traffic: Construct HTTP/1 requests that include a large number of folded header lines (lines beginning with whitespace that continue a previous header value, per RFC 7230).
3. Fragment across multiple packets: Spread the crafted HTTP headers across multiple TCP packets so that Suricata's parser restarts header processing with each new packet, triggering the quadratic complexity on each restart.
4. Sustain the attack: Continuously send such crafted packet streams to maximize CPU consumption in Suricata's header parsing loop, causing progressive slowdown of the IDS/IPS engine.
5. Achieve objective: The sustained resource exhaustion degrades Suricata's inspection throughput, potentially causing it to drop or miss traffic, effectively blinding the network security monitoring capability (GitHub Advisory, GitHub Commit).

• Network: Unusual volume of HTTP/1 traffic containing folded header lines (lines starting with whitespace/tab continuing a header value) spread across many small TCP packets targeting monitored network segments.
• Process: Elevated and sustained CPU usage by the Suricata process (suricata) without a corresponding spike in legitimate traffic volume; potential increase in packet drop rates reported in Suricata stats.
• Logs: Suricata performance logs showing degraded packet processing rates or increased processing latency for HTTP traffic; alerts or warnings related to HTTP header parsing anomalies in suricata.log.

The only available remediation is upgrading Suricata to version 8.0.3 or later, which limits the number of folded header lines processed per header value to 128, bounding the quadratic complexity. No configuration-based workarounds are available. Organizations running Suricata 8.0.0, 8.0.1, or 8.0.2 in production IDS/IPS deployments should prioritize this upgrade given the network-accessible nature of the vulnerability (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by OISF maintainer victorjulien via a GitHub Security Advisory on January 27, 2026, alongside the Suricata 8.0.3 release. Red Hat tracked the issue via Bugzilla and assigned it medium severity. Community discussion has been limited, consistent with the moderate severity rating and absence of public exploit code (GitHub Advisory, Red Hat Bugzilla).