CVE-2026-31934 Suricata smtp/mine: quadratic complexity in extracting urls

High 7.5 Published 2 Apr 2026 Updated 2 Apr 2026

Attackers can cause denial of service in Suricata by sending crafted SMTP messages with MIME-encoded URLs, triggering quadratic complexity in URL extraction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-31934?

CVE-2026-31934 is a high-severity denial of service vulnerability in Oisf Suricata, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, there is a quadratic complexity issue when searching for URLs in mime encoded messages over SMTP leading to a performance impact. This issue has been patched in version 8.0.4.

Weakness: CWE-407

Which versions are affected by CVE-2026-31934?

It affects 1 product.

Products include Oisf Suricata.

How do I fix CVE-2026-31934?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-31934 being exploited?

There is no known exploitation of CVE-2026-31934 in the wild and no public exploit code.

All Oisf Suricata vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-31934, GHSA-hr89-h2pp-f3c8, UBUNTU-CVE-2026-31934.