{"id":"CVE-2026-63452","summary":"Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption","details":"Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.","aliases":["GHSA-j9cx-w9xm-5x84"],"modified":"2026-09-20T08:19:46.904095Z","published":"2026-09-18T20:16:51.951Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-409"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63452.json"},"references":[{"type":"WEB","url":"https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"},{"type":"WEB","url":"https://redmine.openinfosecfoundation.org/issues/8694"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63452.json"},{"type":"ADVISORY","url":"https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63452"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f"},{"type":"FIX","url":"https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/suricata","events":[{"introduced":"9956286fb89f9cad9e9f95b99dc751f8666617b7"},{"fixed":"392b6aee2971a4b5e573850f5d832112509bcb5f"},{"fixed":"e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88"},{"fixed":"4c28cc1b4ac64f48efdca6ce3e09748227a04a7e"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"8.0.0"},{"fixed":"8.0.6"}]}}],"versions":["suricata-8.0.5","suricata-8.0.4","suricata-8.0.3","suricata-8.0.2","suricata-8.0.1","suricata-8.0.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/app-layer-htp.c","function":"HTPConfigParseParameters"},"deprecated":false,"digest":{"function_hash":"38179159653232128359982108201015064381","length":12561},"id":"CVE-2026-63452-2bf7e418","signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f","target":{"file":"src/app-layer-htp.c"},"deprecated":false,"digest":{"line_hashes":["291809367773534891023926368879137509215","60056820487057074604328710503682871343","100160158036436882087892290116696859843","307006587741723591369314138180683001632","26360293686979073754880502759647259577","88361150041729637503887791192492510398","62635643845076058107130711011410850358","73223776517420376105223777614243571183"],"threshold":0.9},"id":"CVE-2026-63452-5932c684","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/oisf/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f","target":{"file":"src/app-layer-htp.c","function":"HTPConfigParseParameters"},"deprecated":false,"digest":{"function_hash":"38179159653232128359982108201015064381","length":12561},"id":"CVE-2026-63452-ac11dd09","signature_type":"Function"},{"digest":{"line_hashes":["291809367773534891023926368879137509215","60056820487057074604328710503682871343","100160158036436882087892290116696859843","307006587741723591369314138180683001632","26360293686979073754880502759647259577","88361150041729637503887791192492510398","62635643845076058107130711011410850358","73223776517420376105223777614243571183"],"threshold":0.9},"id":"CVE-2026-63452-ae4c43f8","signature_type":"Line","signature_version":"v1","source":"https://github.com/oisf/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88","target":{"file":"src/app-layer-htp.c"},"deprecated":false}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63452.json","vanir_signatures_modified":"2026-09-20T08:19:46Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}