CVE-2025-53538

Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.06

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-53538 are affected in suricata 7.0.10	Windows
Vulnerabilities CVE-2025-53538,CVE-2025-59147,CVE-2025-59148,CVE-2025-59149 are affected in suricata 8.0.0-beta1	Windows
Vulnerabilities CVE-2025-53538,CVE-2025-59147,CVE-2025-59148,CVE-2025-59149 are affected in suricata 8.0.0-rc1	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234