VYPR
← All advisories
Critical severity9.4NVD Advisory· Published Sep 20, 2026· Updated Sep 28, 2026

CVE-2026-94083

CVE-2026-94083

Description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Oisf/Suricata2 versions
    cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*range: <8.0.7
    • (no CPE)range: <8.0.7

Patches

Vulnerability mechanics

References

3

News mentions

1