CVE-2026-94083
published 2026-09-20CVE-2026-94083: Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual…
PriorityP354critical9.4CVSS 3.1
AVNACLPRNUINSUCHIHAL
EPSS
0.54%
44.6th percentile
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | < 8.0.7 | 8.0.7 |
| oisf | suricata | >= 8.0.0 < 8.0.7 | 8.0.7 |
CVSS provenance
nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_redhat9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
suricata: suricata: type confusion and invalid free in DoH2 protocol handling
vendor_redhat·2026-09-20·CVSS 9.4
CVE-2026-94083 [CRITICAL] CWE-843 suricata: suricata: type confusion and invalid free in DoH2 protocol handling
suricata: suricata: type confusion and invalid free in DoH2 protocol handling
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
A flaw was found in Suricata's DNS over HTTPS 2 (DoH2) application-layer protocol parser. When processing a DoH2 request accompanied by an HTTP/1 to HTTP/2 upgrade, Suricata mistakenly executes HTTP/2 state cleanup logic while the protocol handler is in an HTTP/1 state. A remote, unauthenticated attacker can exploit this type confusion by sending crafted protocol upgrade traffic to trigger a
VulDB
OISF Suricata up to 8.0.6 type confusion
vuldb·2026-09-20
CVE-2026-94083 OISF Suricata up to 8.0.6 type confusion
A vulnerability, which was classified as very critical, was found in OISF Suricata up to 8.0.6. Affected by this vulnerability is an unknown functionality. Such manipulation leads to type confusion.
This vulnerability is referenced as CVE-2026-94083. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
GHSA
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request
ghsa_unreviewed·2026-09-20
CVE-2026-94083 [CRITICAL] CWE-843 Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [fedora-all]
bugzilla·2026-10-02·CVSS 9.4
CVE-2026-94083 [CRITICAL] CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [fedora-all]
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Bugzilla
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [epel-all]
bugzilla·2026-10-02·CVSS 9.4
CVE-2026-94083 [CRITICAL] CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [epel-all]
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Bugzilla
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling
bugzilla·2026-09-22·CVSS 9.4
CVE-2026-94083 [CRITICAL] CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling
CVE-2026-94083 suricata: suricata: type confusion and invalid free in DoH2 protocol handling
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
2026-09-20
Published