External risk intelligence

Suricata HTTP/2 Protocol Handling Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-45764

Suricata is a network intrusion detection and prevention system typically deployed at network perimeters or on span ports to monitor ingress and egress traffic. Because it is designed to inspect live network traffic, including HTTP/2, it is commonly positioned in environments where it is exposed to internet-sourced traffic, making it a likely candidate for public-facing network monitoring roles.

Denial of Service

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Suricata, a network security monitoring engine, that could allow attackers to crash the system when processing specific HTTP/2 traffic. This could lead to a denial-of-service condition, impacting the availability of network monitoring and protection.

Flaw crashes network security monitoring.
Potential service disruption requires attention.
Confirm relevance and exposure of Suricata.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted HTTP/2 traffic to a Suricata system that is inspecting network traffic. If Suricata processes this malicious traffic, it could lead to a type confusion vulnerability, causing the system to crash and resulting in a denial of service.

Network exposure is required.
Vulnerable HTTP/2 traffic triggers the flaw.
Unavailability of network monitoring.

Live Threat

Current exploitation, exposure, and threat context

A protocol change while processing HTTP/2 traffic could lead to a type confusion vulnerability in Suricata. When crafted traffic is sent, Suricata may crash, causing a denial of service. This issue is relevant when Suricata is configured to parse HTTP/2 traffic.

Intrusion detection and prevention service.
Crash triggered by crafted HTTP/2 traffic.
Denial of service to network monitoring.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for network security and intrusion detection, such as Network Security Operations or Security Engineering, should prioritize addressing this critical denial-of-service vulnerability in Suricata. The first step is to identify all deployed instances of Suricata, assess their exposure to potentially malicious HTTP/2 traffic, and confirm their criticality to business operations. Once identified, the accountable owner must be located to plan and execute remediation, which may involve coordination with vendors or the implementation of temporary workarounds like disabling HTTP/2 parsing if feasible.

Network/Security teams own the resolution.
Verify Suricata instance exposure and criticality.
Plan remediation or implement HTTP/2 workaround.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Suricata?

Suricata is an open-source engine used by network security teams to monitor traffic, detect intrusions, and prevent malicious activity. It acts as a gatekeeper, analyzing data packets as they move across a network—including modern HTTP/2 web traffic—to identify and block potential threats before they reach internal systems.

What does type confusion mean in CVE-2026-45764?

CWE-843, or type confusion, occurs when software accesses a piece of data as if it were a different data type than it actually is. In this case, Suricata misinterprets specific HTTP/2 traffic structures during processing. This logic error causes the application to behave unexpectedly, ultimately forcing the security service to crash.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted HTTP/2 traffic to a system where Suricata is actively inspecting network packets. It is important to note that internal, legitimate traffic using standard HTTP/2 patterns does not automatically trigger the crash; the issue specifically requires malicious input designed to exploit how the software handles protocol changes.

Is my network at risk according to Halo Surface Signal?

Halo Surface Signal identifies Suricata as a highly relevant component because it is frequently deployed at network perimeters to inspect incoming internet traffic. Because your instances may be positioned to monitor external data, they are inherently exposed to the type of malicious HTTP/2 traffic needed to trigger this denial-of-service vulnerability.

What should I do to secure my Suricata installation?

Start by identifying all active Suricata deployments and determining if they are configured to parse HTTP/2 traffic. If you cannot update to versions 7.0.16 or 8.0.5 immediately, you can implement a workaround by disabling HTTP/2 parsing on affected sensors to prevent potential crashes while you plan your upgrade path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.