CVE-2024-23839CWE-416

Suricata http: heap use after free with http.request_header and http.response_header keywords

High · published February 26, 2024

CVSS v3.1
7.1
EPSS
1%
Percentile
55.6
In the wild
Unconfirmed
What it is

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the ruleset uses the http.request_header or http.response_header keyword. The vulnerability has been patched in 7.0.3. To work around the vulnerability, avoid the http.request_header and http.response_header keywords.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00784 · 55.6th percentile
Weakness
CWE-416 · Use After Free
Published
2024-02-26T15:48Z
EPSS history
Timeline
  • 26 FEB 15:48Z
    Suricata http: heap use after free with http.request_header and http.response_header keywords
    cvelistv5