CVE-2025-53538 Details
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.
A vulnerability in Suricata, a network IDS, IPS, and NSM engine, has been identified in versions 7.0.10 and prior, as well as 8.0.0-beta1 through 8.0.0-rc1. The issue arises from improper management of data on HTTP/2 stream 0, which can cause uncontrolled memory consumption, leading to a degradation of visibility within the application. This vulnerability can be exploited by sending HTTP/2 frames of type DATA on stream 0, contrary to the protocol's specifications, which require such frames to be treated as a connection error.
Users can upgrade to Suricata versions 7.0.11 or 8.0.0 to address this vulnerability. Alternatively, the HTTP/2 parser can be disabled, and a specific signature can be used to drop HTTP/2 frames on stream 0.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oisf suricata | < 7.0.11 8.0.0 beta1 8.0.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 6, 2025 | Initial Analysis | [email protected] |
| Jul 22, 2025 | New CVE Received | [email protected] |