10 matches found
DEBIAN-CVE-2026-94083
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...
CVE-2026-94083
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...
CVE-2026-94083
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...
CVE-2026-94083
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...
CVE-2026-94083
Suricata before 8.0.7 is affected by a DoH2 type confusion vulnerability. When a DoH2 request includes an HTTP/1 to HTTP/2 upgrade, the HTTP/2 state cleanup code is executed even though the actual connection state is HTTP/1, leading to an invalid free . The issue requires app-layer.protocols.doh2...
EUVD-2026-83638
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...
Linux Distros Unpatched Vulnerability : CVE-2026-94083
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual stat...
CVE-2026-71418 Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...
CVE-2026-71418
Suricata is a network IDS/IPS/NMS engine. Affected versions are 8.0.0 through 8.0.6 . The vulnerability resides in DNS-over-HTTP/2 (DoH2) processing in rust/src/http2/http2.rs, where previously processed HTTP/2 DATA frame contents are retained in the internal buffer instead of being cleared. An a...
CVE-2026-71418 Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...