CVE-2024-32663highCWE-400CWE-770

CVE-2024-32663: high-severity vulnerability in OISF suricata

Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation

Published · Updated

Follow this CVE+ Monitor suricata+ Monitor suricata

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
In short

Suricata's HTTP/2 parser has a flaw where small amounts of specially crafted traffic can cause the system to use excessive memory, potentially crashing it or making it unresponsive. This happens because the parser doesn't properly handle compressed headers.

Technical detail

The vulnerability exists in the HTTP/2 header decompression logic (CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling). An attacker can send minimal HTTP/2 traffic with malformed compressed headers that trigger disproportionate memory allocation in Suricata versions before 7.0.5 and 6.0.19, leading to denial of service through resource exhaustion.

Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricata
Related CVEs — OISF suricata

In the same product, most dangerous first.

CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2024-38535HIGHSuricata http2: oom from duplicate headersEPSS 1.2%CVE-2024-23836HIGHcrafted traffic can cause denial of serviceEPSS 1.2%CVE-2024-55627MEDIUMSuricata segfault on StreamingBufferSlideToOffsetWithRegionsEPSS 1.0%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%CVE-2024-38536HIGHSuricata http/range: NULL-ptr deref when http.memcap is reachedEPSS 0.9%