CVE-2026-94083

www.tenable.com • September 20, 2026

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

Published : 2026-09-20

Vector : CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Suricata Flaws Allow Network Crashes On September 20, 2026, the OISF released Suricata 8.0.7 to address two critical vulnerabilities, CVE-2026-94084 and CVE-2026-94083, both with a CVSS score of 9.4. These flaws allow unauthenticated attackers to crash the Suricata IDS/IPS, bypassing network monitoring. CVE-2026-94084 is a use-after-free vulnerability in HTTP/2 inspection, while CVE-2026-94083 involves type confusion in the DoH2 parser. Both vulnerabilities affect all Suricata versions prior to 8.0.7. The flaws expose significant risks, especially in environments using default configurations. Organizations are urged to update to the latest version to mitigate these risks. 2 sources 72

Extracted Entities

CVE-2026-94083

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)