CVE-2026-63452: 
Suricata vulnerability analysis and mitigation

CVE-2026-63452 is a denial-of-service vulnerability in Suricata's HTTP/1 parser caused by improper handling of repeated brotli compression bombs within a single network flow. Affecting Suricata versions 8.0.0 through 8.0.5, the flaw allows unauthenticated remote attackers to exhaust CPU resources and degrade or disable packet processing and network security monitoring. The vulnerability was discovered by OSS-Fuzz, published on September 18, 2026, and fixed in Suricata 8.0.6. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) combined with improper handling of highly compressed data (CWE-409). Suricata's HTTP/1 parser, implemented via the rust/htp library, limits decompression work on a per-transaction basis but lacks a per-flow limit on the total number of brotli compression bomb events. When response-body-decompress-layer-limit is enabled, an attacker can craft a single HTTP/1 flow containing many small brotli compression bombs; each transaction triggers expensive decompression work in the Rust HTP decompressor, cumulatively consuming excessive CPU. The fix introduces a configurable compression-bomb-count limit (defaulting to 3) tracked per ConnectionParser instance, after which decompression is skipped for the remainder of the flow and a COMPRESSION_BOMB_LIMIT_REACHED log event is emitted (GitHub Advisory, Commit 392b6ae).

Successful exploitation degrades Suricata's packet processing performance, potentially causing complete loss of network security monitoring visibility or a denial-of-service condition for the IDS/IPS/NSM engine. There is no confidentiality or integrity impact — the attack exclusively targets availability. Because Suricata is a security monitoring component, its disruption could allow malicious traffic to pass undetected, indirectly enabling further attacks on monitored networks (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-63452. The vulnerability is automatable (no user interaction or privileges required) and exploitable over the network with low attack complexity, making it straightforward for any network-adjacent attacker to trigger. The EPSS score is approximately 0.36%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Identify target: Locate a network segment monitored by Suricata 8.0.0–8.0.5 with response-body-decompress-layer-limit enabled (the default configuration).
2. Craft brotli compression bombs: Prepare multiple small HTTP/1 responses where each response body is a valid brotli-compressed payload that expands to a large output, exceeding Suricata's per-transaction bomb threshold.
3. Establish a single HTTP/1 flow: Initiate a TCP connection to any HTTP server visible to the Suricata sensor, or act as a server responding to a monitored client, ensuring all crafted responses are delivered within the same TCP flow.
4. Send repeated compressed responses: Deliver the brotli compression bomb responses sequentially within the same flow, causing Suricata's HTP decompressor to perform expensive decompression work for each transaction without a per-flow cap.
5. Exhaust CPU resources: The cumulative decompression work degrades Suricata's packet processing thread, causing packet drops, monitoring gaps, or a complete denial-of-service of the Suricata engine (GitHub Advisory, Commit 392b6ae).

• Logs: Suricata log entries containing COMPRESSION_BOMB or COMPRESSION_BOMB_LIMIT_REACHED HTP log codes for the same flow; repeated compression_bomb_limit reached error messages in suricata.log or eve.json from a single source IP or flow.
• Network: A single HTTP/1 TCP flow delivering an unusually high number of brotli-compressed response bodies in rapid succession; high CPU utilization on the Suricata worker process correlated with specific flows.
• Alerts: Suricata rule sid:2221059 firing — alert http any any -> any any (msg:"SURICATA HTTP compression bomb limit reached"; flow:established; app-layer-event:http.compression_bomb_limit_reached; ...) — indicates the threshold was reached on a flow (available in patched versions) (Commit 392b6ae).

Upgrade Suricata to version 8.0.6, which introduces a per-flow compression bomb count limit (default: 3) and skips further decompression once the threshold is reached. If immediate patching is not possible, two workarounds are available: (1) disable HTTP body decompression entirely by setting app-layer.protocols.http.libhtp.default-config.response-body-decompress-layer-limit: 0 in suricata.yaml; or (2) deploy a Suricata rule to drop and bypass flows triggering the compression bomb event: drop http any any -> any any (msg:"SURICATA HTTP compression bomb"; flow:established; app-layer-event:http.compression_bomb; sid:1; bypass;). Additionally, network-level rate limiting on compressed HTTP responses from untrusted sources can reduce exposure (GitHub Advisory, Suricata 8.0.6 Release).

The vulnerability was credited to OSS-Fuzz, reflecting the ongoing value of automated fuzzing in discovering security issues in network security tooling. Red Hat tracked the issue via Bugzilla with high severity and priority. A Mastodon post referencing the advisory was observed in the community shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified (GitHub Advisory, Red Hat Bugzilla).