Suricata http: heap use after free with http.request_header and http.response_header keywords

Suricata, a network security tool, has a memory bug where specially crafted network traffic can cause it to crash or behave unpredictably if rules check HTTP request or response headers. This affects the tool's ability to monitor and protect networks reliably.

A heap use-after-free vulnerability (CWE-416) exists in Suricata versions prior to 7.0.3 when processing HTTP headers via the http.request_header or http.response_header keywords. Malicious or specially crafted network traffic can trigger memory corruption, leading to information disclosure or denial of service. The vulnerability requires the vulnerable keywords to be present in active ruleset configurations.