PT-2024-1594 · Suricata · Suricata

Victorjulien · Published 2024-02-08 · Updated 2025-07-28 · CVE-2024-24568

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.3

Description The issue is related to the rules inspecting HTTP2 headers in Suricata, which can be bypassed by crafted traffic. This can potentially allow a remote attacker to compromise the integrity of protected information. The vulnerability has been patched in version 7.0.3.

Recommendations For Suricata versions prior to 7.0.3, update to version 7.0.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTTP2 headers inspection rules until a patch is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1395

Related Identifiers

BDU:2024-01184

CVE-2024-24568

GHSA-GV29-5HQW-5H8C

OPENSUSE-SU-2025:15394-1

Affected Products

Suricata

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24568.json · Exploit
• https://github.com/OISF/suricata/security/advisories/GHSA-gv29-5hqw-5h8c · Vendor Advisory
• https://github.com/OISF/suricata/commit/478a2a38f54e2ae235f8486bff87d7d66b6307f0 · Patch
• https://osv.dev/vulnerability/CVE-2024-24568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24568 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24568 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24568 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15394-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01184 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-24568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24568 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24568 · Vendor Advisory
• https://suse.com/security/cve/CVE-2024-47188 · Note