CVE-2026-31935

{
  "id": "CVE-2026-31935",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-02T15:16:37.657",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft HTTP2 continuation frames can lead to memory exhaustion, usually resulting in the Suricata process being shut down by the operating system. This issue has been patched in versions 7.0.15 and 8.0.4."
    },
    {
      "lang": "es",
      "value": "Suricata es un motor IDS, IPS y NSM de red. Antes de las versiones 7.0.15 y 8.0.4, la inundación de tramas de continuación HTTP2 manipuladas puede provocar el agotamiento de la memoria, lo que normalmente resulta en el cierre del proceso de Suricata por parte del sistema operativo. Este problema ha sido parcheado en las versiones 7.0.15 y 8.0.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OISF",
          "product": "suricata",
          "versions": [
            {
              "version": "< 7.0.15",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0, < 8.0.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T18:42:22.298340Z",
          "id": "CVE-2026-31935",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "7.0.15",
              "matchCriteriaId": "1E0D4CF4-11E0-4FB1-9C17-F38257D376ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.0.4",
              "matchCriteriaId": "F35C5A48-CA30-43B3-9E53-D3E51C862604"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/OISF/suricata/security/advisories/GHSA-vxrp-5pg7-7v4x",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://redmine.openinfosecfoundation.org/issues/8289",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ]
    }
  ]
}