Suricata 8.x < 8.0.7 Type Confusion (CVE-2026-94083)

The version of OISF Suricata installed on the remote host is 8.x prior to 8.0.7. It is, therefore, affected by a vulnerability: - Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is...

CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

PT-2026-95902

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.7 Description A type confusion exists in the handling of DoH2 DNS over HTTP/2 when a DoH2 request occurs during an HTTP1 to HTTP2 upgrade. This issue occurs because the cleanup code for the HTTP2 state is execute...