java-topology/whitepaper/outreach/suricata-0002.md

Suricata — CWE-407 Disclosure Brief (suricata-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Suricata's Eve JSON HTTP logger. The header field membership test scans all 53 possible HTTP field entries for every header on every HTTP transaction, even when only a handful of fields are enabled. Patched.

The Defects

suricata-0002 (PATCHED — MEDIUM): src/output-json-http.c:326

// In EveHttpLogJSONHeaders() — fires per HTTP transaction, per direction:
for (HttpField f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) {
    if ((http_ctx->fields & (1ULL << f)) != 0) {
        if (bstr_cmp_c_nocase(htp_header_name(h), http_fields[f].htp_field)) {
            tolog = true;
            break;
        }
    }
}

When custom field logging is configured, each header is checked against the full HTTP_FIELD_SIZE=53 field array. With H headers and F=53 fields, cost per transaction is O(H×F). Typical deployments enable 1-5 fields, so 48-52 iterations per header are wasted.

Complexity Proof

suricata-0002: At H=50 headers, F=53 fields, E=1 enabled field:

• Defective: 50 × 53 = 2,650 iterations per transaction (scanning all fields)
• Fixed: 50 × 1 = 50 iterations (scanning only enabled fields)
• ~8× op reduction per HTTP transaction. Fires on every logged HTTP flow.

Impact

Suricata is the leading open-source network intrusion detection/prevention system, deployed by enterprises, governments, and ISPs worldwide for real-time traffic analysis. Eve JSON logging is the primary structured output format. In high-throughput deployments processing millions of HTTP transactions per hour, the unnecessary iteration cost compounds across every logged flow.

The Fix

suricata-0002: Precompute a NULL-terminated array of enabled field names at config time. Replace the full-scan inner loop with iteration over only the enabled fields:

// Before — O(H × F) per transaction
for (HttpField f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) { ... }

// After — O(H × E) per transaction, E << F
// enabled_htp_fields[] built once at config time
for (uint32_t ei = 0; ei < http_ctx->enabled_htp_fields_cnt; ei++) {
    if (bstr_cmp_c_nocase(htp_header_name(h), http_ctx->enabled_htp_fields[ei])) {
        tolog = true;
        break;
    }
}

Patch

Fix available: defects/suricata-0002/patch/suricata-0002.patch

Single-file patch in src/output-json-http.c. Adds a precomputed enabled-fields array to LogHttpFileCtx_, populated at init, scanned at runtime.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign an issue reference (OISF/suricata).
2. Assess severity — fires on every HTTP transaction with custom field logging enabled.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Suricata team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.