CVE-2026-22260 Suricata http1: infinite recursion in decompression

High 7.5 Published 27 Jan 2026 Updated 27 Jan 2026

An attacker can cause a stack overflow and crash the Suricata network IDS/IPS engine via infinite recursion in HTTP decompression.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-22260?

CVE-2026-22260 is a high-severity denial of service vulnerability in Oisf Suricata, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `response-body-limit`.

Weakness: CWE-787, CWE-674

Which versions are affected by CVE-2026-22260?

It affects 1 product.

Products include Oisf Suricata.

How do I fix CVE-2026-22260?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-22260 being exploited?

There is no known exploitation of CVE-2026-22260 in the wild and no public exploit code.

All Oisf Suricata vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-22260, GHSA-3gm8-84cm-5x22, UBUNTU-CVE-2026-22260.