CVE-2026-94083

CRITICAL 9.4

CVSS Score

9.4

EPSS Score

0.0%

EPSS Percentile

0th

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

CWE	CWE-843
Vendor	oisf
Product	suricata
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for oisf suricata

Be the first to know when new critical vulnerabilities affecting oisf suricata are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

OISF / Suricata

8.0.0 < 8.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

forum.suricata.io: https://forum.suricata.io/t/suricata-8-0-7-released/6467 github.com: https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074 github.com: https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7