CVE-2026-22263CWE-1050

Suricata http1: quadratic complexity in headers parsing over multiple packets

Medium · published January 27, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-1050 · Excessive Platform Resource Consumption within a Loop
Published
2026-01-27T18:27Z
EPSS history
Timeline
  • 27 JAN 18:27Z
    Suricata http1: quadratic complexity in headers parsing over multiple packets
    cvelistv5