Suricata <8.0.7 DoH2 type confusion leads to invalid free
CVE-2026-94083 Published on September 20, 2026
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Vulnerability Analysis
CVE-2026-94083 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
What is an Object Type Confusion Vulnerability?
The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVE-2026-94083 has been classified to as an Object Type Confusion vulnerability or weakness.
Products Associated with CVE-2026-94083
Want to know whenever a new CVE is published for Oisf Suricata? stack.watch will email you.
Affected Versions
OISF Suricata:- Version 8.0.0 and below 8.0.7 is affected.