CVE-2026-31935: 
Suricata vulnerability analysis and mitigation

CVE-2026-31935 is a denial-of-service vulnerability in Suricata, the open-source network IDS, IPS, and NSM engine, caused by unbounded resource consumption when processing HTTP/2 continuation frames. An unauthenticated remote attacker can flood a Suricata instance with crafted HTTP/2 CONTINUATION frames, leading to memory exhaustion and typically causing the Suricata process to be terminated by the operating system. All Suricata versions prior to 7.0.15 and versions 8.0.0 through 8.0.3 are affected. The vulnerability was published on April 2, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling): Suricata's HTTP/2 parser does not impose limits on the number or size of CONTINUATION frames it processes, allowing an attacker to continuously send crafted frames that cause unbounded memory allocation. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply needs to send a flood of malicious HTTP/2 CONTINUATION frames to a network segment monitored by Suricata. The vulnerability was credited to Arrowshao and Wilburzhang of Tencent Security YUNDING LAB (GitHub Advisory).

Successful exploitation results in memory exhaustion on the host running Suricata, causing the IDS/IPS/NSM process to be killed by the operating system, effectively disabling network threat detection and prevention capabilities. There is no confidentiality or integrity impact — the sole consequence is a high availability impact. In environments where Suricata operates in inline IPS mode, its termination could also allow malicious traffic to pass uninspected, indirectly increasing risk to protected assets (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Reconnaissance: Identify network segments or hosts running a vulnerable Suricata instance (versions prior to 7.0.15 or 8.0.0–8.0.3) by observing network monitoring behavior or querying exposed management interfaces.
2. Craft malicious HTTP/2 traffic: Construct HTTP/2 sessions containing a large number of CONTINUATION frames without a terminating END_HEADERS flag, exploiting the lack of frame count or memory limits in Suricata's HTTP/2 parser.
3. Flood the target: Continuously send the crafted HTTP/2 CONTINUATION frame floods across the network segment being monitored by Suricata, causing the engine to allocate memory without bound for each frame received.
4. Trigger memory exhaustion: As memory consumption grows unchecked, the operating system's OOM (Out-Of-Memory) killer terminates the Suricata process, disabling IDS/IPS/NSM functionality on the affected segment (GitHub Advisory).

• Network: Unusual volume of HTTP/2 CONTINUATION frames (frame type 0x9) in traffic captures, particularly sessions with a very high number of CONTINUATION frames and no END_HEADERS flag; sustained high-rate HTTP/2 traffic from a single or small set of source IPs.
• Logs: Suricata logs showing sudden process termination or OOM-related errors; system logs (e.g., /var/log/syslog, dmesg) recording OOM killer events targeting the Suricata process.
• Process: Suricata process absent or repeatedly restarting; abnormally high memory consumption by the Suricata process prior to termination as observed via top, htop, or system monitoring tools.
• File System: Core dump files generated by Suricata in the working directory following unexpected termination (GitHub Advisory).

Upgrade Suricata to version 7.0.15 or 8.0.4 (or later), which contain the official fix for this vulnerability. As interim workarounds, administrators can define a limited stream.reassembly.depth value in the Suricata configuration (setting it to 0 or leaving it absent enables unlimited depth, which is unsafe); alternatively, the HTTP/2 parser can be disabled entirely to eliminate the attack surface. Network-level rate limiting on HTTP/2 CONTINUATION frames via upstream infrastructure may also reduce exposure (GitHub Advisory, Feedly).

The Suricata project released versions 7.0.15 and 8.0.4 on March 17, 2026, with the CVE formally published on April 2, 2026. The vulnerability was reported by researchers Arrowshao and Wilburzhang from Tencent Security YUNDING LAB. Community discussion was noted on the Suricata forum and social media platforms including Mastodon and Bluesky, with openSUSE also issuing a security announcement for its packaged version of Suricata (Suricata Release, openSUSE).