CVE-2026-71418: 
Suricata vulnerability analysis and mitigation

CVE-2026-71418 is a denial-of-service vulnerability in Suricata's DNS-over-HTTP/2 (DoH2) processing engine, caused by failure to clear an internal buffer after processing HTTP/2 DATA frames. Affected versions span 8.0.0 through 8.0.5; version 8.0.6 contains the fix. The vulnerability was discovered by OSS-Fuzz and published on September 18, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling). In rust/src/http2/http2.rs, the DoH2 processing logic retains previously processed HTTP/2 DATA frame contents in an internal buffer (doh.data_buf) instead of clearing it after each processing cycle. An attacker can send multiple crafted HTTP/2 DATA frames with the EndOfStream flag set, causing the buffer to grow up to its 65 KiB limit while triggering reprocessing of all accumulated prior contents — resulting in quadratic CPU complexity (O(n²)). The fix, applied in commits 1731805 and 26c26de, adds a single doh.data_buf[dir.index()].clear() call after buffer processing (GitHub Commit, GitHub Advisory).

Successful exploitation degrades or halts Suricata's packet processing capability, resulting in loss of IDS/IPS/NSM monitoring visibility or a full denial of service. Because Suricata operates as a network security monitoring engine, its disruption can blind defenders to concurrent malicious activity traversing the monitored network segment. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The attack is unauthenticated, network-accessible, and requires no user interaction, making it automatable. The EPSS score is approximately 0.0035 (0.35%), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify network segments monitored by Suricata 8.0.0–8.0.5 instances with DoH2 (DNS-over-HTTP/2) application-layer parsing enabled (the default in affected versions).
2. Craft malicious HTTP/2 traffic: Construct an HTTP/2 session containing multiple DATA frames addressed to a DNS-over-HTTPS endpoint, each with the EndOfStream flag set.
3. Transmit frames: Send the crafted DATA frames in sequence through the monitored network path so Suricata's DoH2 parser processes them. Each frame causes the internal buffer to grow without being cleared, and all prior buffer contents are reprocessed.
4. Trigger quadratic CPU consumption: As the buffer approaches its 65 KiB limit, CPU usage grows quadratically, degrading Suricata's packet processing throughput.
5. Achieve denial of service: Sustained transmission of such frames exhausts CPU resources, causing Suricata to drop packets, lose monitoring visibility, or crash entirely (GitHub Advisory, GitHub Commit).

• Network: Unusual volume of HTTP/2 DATA frames with EndOfStream flags targeting DNS-over-HTTPS endpoints on monitored segments; repeated short-lived HTTP/2 connections sending fragmented DATA frames.
• Process: Suricata process exhibiting sustained high CPU utilization (near 100% on one or more cores) without a corresponding spike in legitimate traffic volume.
• Logs: Suricata stats logs showing a sharp drop in packets processed per second or increased packet drop counters; application-layer DoH2 transaction counts growing abnormally.
• System: System-level alerts for CPU throttling or watchdog timeouts associated with the Suricata process (GitHub Advisory).

Upgrade Suricata to version 8.0.6 or later, which includes the one-line buffer-clear fix in rust/src/http2/http2.rs (Suricata Release). As an interim workaround, disable DoH2 application-layer parsing in the Suricata configuration by setting app-layer.protocols.doh2.enabled: no — this eliminates the attack surface if DNS-over-HTTP/2 inspection is not required (GitHub Advisory). Additionally, consider implementing network-level rate limiting on HTTP/2 traffic processed by Suricata, or restricting DoH2 connections to trusted sources only until patching is complete.

The vulnerability was discovered by OSS-Fuzz, Google's continuous fuzzing infrastructure for open-source projects, and credited in the official GitHub Security Advisory. A Mastodon post referencing the CVE was observed in late September 2026, indicating some community awareness. Red Hat tracked the issue via Bugzilla (Bug 2538956) and assigned it high severity/priority, suggesting downstream Linux distribution impact is being assessed (GitHub Advisory, Red Hat Bugzilla).