VDB
CVE-2026-31935
CVE-2026-31935
PUBLISHED
CVSS 7.5 HIGH
Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4.
EPSS 0.28% · 20.2th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.28%
20.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OISF | suricata | < 7.0.15, >= 8.0.0, < 8.0.4 |
Timeline
- Mar 18, 2026 CVE Published
- Mar 18, 2026 PoC Published
- Mar 18, 2026 PoC Published
- Mar 27, 2026 PoC Published
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score