CVE-2026-22261
Suricata eve/alert: http1 xff handling can lead to denial of service
In short
Suricata's handling of X-Forwarded-For (XFF) headers in HTTP alerts can cause the system to slow down significantly when processing certain network traffic. This vulnerability allows attackers to degrade the performance of network monitoring by sending specially crafted requests.
Technical detail
The vulnerability exists in Suricata's eve/alert module where inefficient XFF header processing, particularly for alerts not associated with an HTTP transaction, can cause denial of service through severe performance degradation. An attacker can exploit this by sending HTTP traffic with XFF headers that trigger the inefficient code path, causing resource exhaustion on the IDS/IPS system.
Summary generated and translated by AI from the official description.
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered in a tx, can lead to severe slowdowns. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, disable XFF support in the eve configuration. The setting is disabled by default.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
OISF · suricataWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →