CVE-2026-94083

Published Sep 20, 2026

Last updated 23 days ago

CVSS critical 9.4

Overview

Description
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Source
cve@mitre.org
NVD status
Analyzed
Products
suricata

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.4
Impact score
5.5
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Severity
CRITICAL

Weaknesses

cve@mitre.org
CWE-843

Social media

Hype score
Not currently trending

  1. Warning: Critical vulnerabilities affecting #Suricata. CVE-2026-94083 (CVSS: 9.4) allows an attacker to trigger a DoS. CVE-2026-94084 (CVSS: 9.4) allows an attacker to conduct DoS or execute arbitrary code due to memory corruption #RCE! #Patch #Patch #Patch

    @CCBalert

    22 Sept 2026

    254 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  2. ⚠️ Vulnerabilidades en productos Suricata ❗ CVE-2026-94084 ❗ CVE-2026-94083 ➡️ Más info: https://t.co/xqYpFt492n https://t.co/yzkl6XTGV1

    @CERTpy

    21 Sept 2026

    211 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Twój IDS też jest powierzchnią ataku. Suricata <8.0.7 ma krytyczne błędy HTTP/2: CVE-2026-94083 i CVE-2026-94084. Jeden dotyczy domyślnie aktywnego DoH2. Aktualizuj do 8.0.7+ i sprawdź konfigurację parserów. #Linux #Security #Suricata https://t.co/R8KMZg3aVZ

    @quietcodelife

    21 Sept 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Suricata's HTTP2 engine had two critical memory-safety bugs at once both fixed in a single release. CVE-2026-94083 is a DoH2 type confusion causing an invalid free. CVE-2026-94084 is a separate Http2ThreadMultiBuf use-after-free triggered by http.response_header rules. Both are

    @vuln_tracker

    21 Sept 2026

    208 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.•CVE-2026-94084
  2. Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.•CVE-2026-71855
  3. Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.•CVE-2026-71418
  4. Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.•CVE-2026-63449
  5. Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.•CVE-2026-63452

References

Sources include official advisories and independent security research.