Suricata

In some cases the HTTP body tracking can use excessive memory. When body limits are high or disabled combined with certain rule sets the body chunks can in some cases not be freed at all. This leads to the entire body remaining in memory, which in case of big transfers leads to resource starvation issues both in memory use and CPU time.