CVE-2024-23839: Suricata http: heap use after free with http.request_header and http.response_header keywords

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-26 · updated 2026-06-17
Weakness: CWE-416

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the ruleset uses the http.request_header or http.response_header keyword. The vulnerability has been patched in 7.0.3. To work around the vulnerability, avoid the http.request_header and http.response_header keywords.

Affected products

Fedoraproject Fedora: 38, 39
OISF suricata: from 7.0.0 before 7.0.3 — fixed in 7.0.3

How to fix

Upgrade to a fixed version: OISF suricata 7.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-23839 or the next vulnerability affects your stack