Vulnerability · Published May 7, 2024 · Assigned by GitHub_M
CVE-2024-32663Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation
High 7.5
In plain English
A high-severity uncontrolled resource consumption in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | suricata | 7.0.6-r0 | ALPINE-CVE-2024-32663 |
| Alpine:v3.21 | suricata | 7.0.6-r0 | ALPINE-CVE-2024-32663 |
| Alpine:v3.22 | suricata | 7.0.6-r0 | ALPINE-CVE-2024-32663 |
| Alpine:v3.23 | suricata | 7.0.6-r0 | ALPINE-CVE-2024-32663 |
| Alpine:v3.24 | suricata | 7.0.6-r0 | ALPINE-CVE-2024-32663 |
| Debian:13 | suricata | 1:7.0.5-1 | DEBIAN-CVE-2024-32663 |
| Debian:14 | suricata | 1:7.0.5-1 | DEBIAN-CVE-2024-32663 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-32663 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-32663 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2024-32663 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-32663 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2024-32663 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-9jxm-qw9v-266r x_refsource_CONFIRM
- https://github.com/OISF/suricata/commit/08d93f7c3762781b743f88f9fdc4389eb9c3eb64 x_refsource_MISC
- https://github.com/OISF/suricata/commit/c0af92295e833d1db29b184d63cd3b829451d7fd x_refsource_MISC
- https://github.com/OISF/suricata/commit/d24b37a103c04bb2667e449e080ba4c8e56bb019 x_refsource_MISC
- https://github.com/OISF/suricata/commit/e68ec4b227d19498f364a41eb25d3182f0383ca5 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/6892 x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/6900 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html