CVE
CVE-2026-94083
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request...
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.4
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
C
H
U
-
Related Resources
No items found.
References
https://forum.suricata.io/t/suricata-8-0-7-released/6467, https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94083.json, https://nvd.nist.gov/vuln/detail/CVE-2026-94083, https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074