Suricata http/range: NULL-ptr deref when http.memcap is reached
No sign of exploitation. No public exploitation artifact known so far.
Suricata crashes when processing HTTP traffic if a memory limit (http.memcap) is exceeded. This happens because the system doesn't properly handle when it runs out of allocated memory, causing the application to fail and stop monitoring network threats.
A NULL pointer dereference occurs in Suricata's HTTP range processing when the http.memcap memory limit is reached, resulting in failed memory allocation that is not properly handled. An attacker can trigger memory exhaustion by sending crafted HTTP requests with large range headers, causing a denial of service by crashing the Suricata process. The vulnerability requires the ability to send network traffic to the monitored interface.