From 0a48101ba091e97fa903d480abc430fab0a030f8 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Fri, 16 Oct 2026 09:14:33 +0200 Subject: [PATCH] http2: anomaly event on continuation frame without preceding headers Ticket: 9217 --- rules/http2-events.rules | 1 + rust/src/http2/http2.rs | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/rules/http2-events.rules b/rules/http2-events.rules index 4ff172ee9b..5559212d9a 100644 --- a/rules/http2-events.rules +++ b/rules/http2-events.rules @@ -28,3 +28,4 @@ alert http2 any any -> any any (msg:"SURICATA HTTP2 data on stream zero"; flow:e # alert http2 any any -> any any (msg:"SURICATA HTTP2 too many frames"; flow:established; app-layer-event:http2.too_many_frames; classtype:protocol-command-decode; sid:2290019; rev:1;) alert http2 any any -> any any (msg:"SURICATA HTTP2 compression bomb"; flow:established; app-layer-event:http2.compression_bomb; classtype:protocol-command-decode; sid:2290020; rev:1;) alert http2 any any -> any any (msg:"SURICATA HTTP2 headers table overflow"; flow:established; app-layer-event:http2.header_table_overflow; classtype:protocol-command-decode; sid:2290021; rev:1;) +alert http2 any any -> any any (msg:"SURICATA HTTP2 continuation without headers"; flow:established; app-layer-event:http2.continuation_without_headers; classtype:protocol-command-decode; sid:2290022; rev:1;) diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs index e64a51a1c7..399341a960 100644 --- a/rust/src/http2/http2.rs +++ b/rust/src/http2/http2.rs @@ -711,6 +711,7 @@ pub enum HTTP2Event { DataStreamZero, TooManyFrames, CompressionBomb, + ContinuationWithoutHeaders, } pub struct HTTP2DynTable { @@ -1261,7 +1262,10 @@ impl HTTP2State { }; return (HTTP2FrameTypeData::CONTINUATION(hs), events); } - } // else try to parse anyways + } else { + events.push(HTTP2Event::ContinuationWithoutHeaders); + } + // else try to parse anyways let input_reass = if head.stream_id == buf.stream_id { &buf.data } else {