CVE-2026-94083 OISF CVE debrief

Who should care

Defenders responsible for Suricata deployments should assess exposure and prioritize upgrading to Suricata version 8.0.7 or later. This critical vulnerability requires immediate attention from operators, platform administrators, vulnerability management teams, and security teams to verify Suricata version and configuration, ensuring the system's security and integrity. The vulnerability's impact on operational security and potential for remote code makes

Why it matters

Defenders should prioritize upgrading to Suricata version 8.0.7 or later to address this critical vulnerability. The vulnerability requires app-layer.protocols.doh2 to be enabled, which is the default setting in Suricata 8.x versions. Defenders responsible for Suricata deployments should assess exposure and verify Suricata version and configuration.

• Potential denial of service due to invalid free
• Possible remote code execution
• Required verification of Suricata version and configuration

Technical summary

The vulnerability is caused by a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions. The issue emphasizes the need for defenders to verify Suricata version and configuration to address this critical vulnerability effectively, focusing on potential denial of service and possible remote code execution impacts.

Defensive priority

Defenders should prioritize upgrading to Suricata version 8.0.7 or later to address this vulnerability.

Recommended defensive actions

• Upgrade to Suricata version 8.0.7 or later
• Verify app-layer.protocols.doh2 is not required for your deployment
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.