Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation
Summary
Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation
Original description
The description as published by the source.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing app-layer.protocols.http2.max-table-size value (default is 65536).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-32663 suricata Fixed in: 1:6.0.1-3+deb11u1
- Ubuntu UBUNTU-CVE-2024-32663 suricata
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- web lists.debian.org
- web redmine.openinfosecfoundation.org
- web redmine.openinfosecfoundation.org