CVE-2026-94083: Critical severity OISF Suricata vulnerability
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.7 - Configuration
If you cannot immediately upgrade, disable DoH2 by setting app-layer.protocols.doh2 to disabled (the DoH2 type confusion occurs when this app-layer feature is enabled).
Suricata app-layer.protocols.doh2 = disabled
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Suricata 8.x deployments with app-layer.protocols.doh2 enabled are exposed; this setting is enabled by default in 8.x. The issue affects versions before 8.0.7.
What traffic is needed to trigger the flaw?
An attacker needs to send a DoH2 request involving an HTTP/1 to HTTP/2 upgrade. No privileges or user interaction are required according to the supplied severity vector.
What can be done if upgrading is not immediately possible?
Disable app-layer.protocols.doh2 to remove the required condition for exploitation. This may affect DoH2 protocol handling.
How can I determine whether an installation is affected?
Check whether Suricata is running a version earlier than 8.0.7 and whether app-layer.protocols.doh2 is enabled. In 8.x, the setting is enabled by default unless it has been changed.