CVE-2024-32663 json
Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation
published 2024-05-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-30454
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount of HTTP/2 traffic can lead to Suricata using a large amount of memory. The issue has been addressed in Suricata 7.0.5 and 6.0.19. Workarounds include disabling the HTTP/2 parser and reducing `app-layer.protocols.http2.max-table-size` value (default is 65536).
Patch / fix
- oisf suricata 6.0.19, 7.0.5
- openinfosecfoundation suricata 6.0.19, 7.0.5
- suricata-ids suricata 6.0.19, 7.0.5
- suricata Debian 14, Debian 13 1:7.0.5-1
debian advisories DEBIAN-CVE-2024-32663
- suricata openSUSE Tumbleweed 8.0.0-1.1
opensuse advisories openSUSE-SU-2025:15394-1
- suricata Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 7.0.6-r0
alpine advisories ALPINE-CVE-2024-32663
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- OISF suricata
Classification
References
-
github.com
/OISF/suricata/commit/08d93f7c3762781b743f88f9fdc4389eb9c3eb64
patch
-
github.com
/OISF/suricata/commit/c0af92295e833d1db29b184d63cd3b829451d7fd
patch
-
github.com
/OISF/suricata/commit/d24b37a103c04bb2667e449e080ba4c8e56bb019
patch
-
github.com
/OISF/suricata/commit/e68ec4b227d19498f364a41eb25d3182f0383ca5
patch
-
github.com
/OISF/suricata/security/advisories/GHSA-9jxm-qw9v-266r
vendor-advisory
-
redmine.openinfosecfoundation.org
/issues/6892
issue-tracking
-
redmine.openinfosecfoundation.org
/issues/6900
issue-tracking
- lists.debian.org /debian-lts-announce/2025/03/msg00029.html
Sources
- CVE List CVE-2024-32663
- NVD CVE-2024-32663
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.