High · published November 27, 2025
⚡ Suricata has a memory monster lurking in versions 8.0.0 to just before 8.0.2, where compressed HTTP data can cause unbounded memory growth during decompression! Think of it like a sponge in a restaurant kitchen — if it keeps soaking up water without ever being wrung out, it’ll overflow and create a mess! This vulnerability allows Suricata to soak up memory endlessly, leading to potential outages. An attacker could leverage this unbounded growth to exhaust system resources, causing the Suricata engine to slow down or even crash. This could leave your network blind, making it a prime target for attackers during downtime — absolutely devastating!
Think of it like a sponge in a restaurant kitchen — if it keeps soaking up water without ever being wrung out, it’ll overflow and create a mess! This vulnerability allows Suricata to soak up memory endlessly, leading to potential outages. This vulnerability arises from improper handling of compressed HTTP data in Suricata, allowing an attacker to trigger excessive memory usage. When the engine tries to decompress data, it fails to impose limits on memory allocation, leading to potential denial of service.
An attacker could leverage this unbounded growth to exhaust system resources, causing the Suricata engine to slow down or even crash. This could leave your network blind, making it a prime target for attackers during downtime — absolutely devastating! To secure your systems, upgrade immediately to version 8.0.2 where this issue has been resolved. If updating isn't feasible, consider disabling LZMA decompression or limiting the response body size as a temporary workaround. You've got this! Following these steps will help you keep your network safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| oisf/suricata | ≥ 8.0.0, < 8.0.2 | 8.0.2 |