Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a029ba03cc advisory.

    CVE-2025-53537: HIGH     CVE-2025-53538: HIGH

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f555a9146a advisory.

    CVE-2025-53537: HIGH     CVE-2025-53538: HIGH

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation)     and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of     data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds     include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any     (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2     frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.
    (CVE-2025-53538)

Note that Nessus relies on the presence of the package as reported by the vendor.

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid:
1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253435	Fedora 41 : suricata (2025-a029ba03cc)	Nessus	Fedora Local Security Checks	high
253068	Fedora 42 : suricata (2025-f555a9146a)	Nessus	Fedora Local Security Checks	high
245422	Linux Distros Unpatched Vulnerability : CVE-2025-53538	Nessus	Misc.	high
243230	Suricata < 7.0.11 DoS	Nessus	Misc.	high

Detections

Analytics

CVE-2025-53538

high

Tenable Plugins

high

high

high

high