CVE-2026-94083 OISF CVE debrief

Who should care

Defenders and security teams responsible for Suricata deployments, especially those using Suricata 8.x versions, should assess their exposure and verify the need for updates or patches.

Why it matters

A critical vulnerability in Suricata before 8.0.7 can lead to an invalid free due to DoH2 type confusion. Defenders should verify exposure, especially for Suricata 8.x versions, and assess the need for updates or patches.

• Potential for invalid free due to DoH2 type confusion
• Cleanup code execution for HTTP2 state even in HTTP1 state
• Requires verification of exposure and remediation details

Technical summary

The vulnerability is caused by a DoH2 type confusion in Suricata before 8.0.7, which can lead to an invalid free. This occurs when the cleanup code for the HTTP2 state is executed even though the actual state is HTTP1, specifically when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. The app-layer.protocols.doh2 needs to be enabled for this vulnerability to be exploitable, which is the default setting in Suricata 8.x versions.

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for updates or patches, especially for Suricata 8.x versions where app-layer.protocols.doh2 is enabled by default.

Recommended defensive actions

• Verify Suricata version and configuration to assess exposure
• Review and apply patches or updates for Suricata 8.x versions
• Monitor for official advisories and guidance from Suricata maintainers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but specific details about exploitation, impact, and remediation require further verification from official Suricata sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.