CVE-2026-94083

9.4 CRITICALpublic exploit available

Published 2026-09-20 · Updated 2026-09-22

AI risk analysis

Summary: This flaw in Suricata before 8.0.7 involves a DoH2 type confusion that can lead to an invalid free operation, impacting system stability and security.
Exploitability: Exploitation requires enabling the DoH2 protocol, which is default in 8.x versions, making it moderately easy for attackers with access to the service.
Blast radius: If exploited, this could lead to denial of service or other security issues, impacting the affected system's availability and integrity.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Suricata 8.0.7 or later.

dosprotocol-confusionnetwork

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-843

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.