CVE-2026-63452

Name of the Vulnerable Software and Affected Versions Suricata versions 8.0.0 through 8.0.5

Description The HTTP/1 parser limits decompression work per transaction but fails to limit the number of small brotli compression bombs a single flow can submit. When the response-body-decompress-layer-limit is enabled, repeated compressed responses force the decompression paths in rust/htp to perform expensive operations for every transaction. This can degrade packet processing, potentially leading to a denial of service or loss of monitoring visibility.

Recommendations Update to version 8.0.6.