CVE-2026-94083: 
Suricata vulnerability analysis and mitigation

CVE-2026-94083 is a type confusion vulnerability in Suricata's DoH2 (DNS over HTTPS 2) protocol handling that can cause an invalid memory free, potentially leading to process crashes or memory corruption. When a DoH2 request is processed with an HTTP/1 to HTTP/2 upgrade, the cleanup code for the HTTP2 state is incorrectly executed even though the actual application-layer state remains HTTP1, resulting in an invalid free condition. The vulnerability affects Suricata versions 8.0.0 through 8.0.6 (before 8.0.7), and exploitation requires the app-layer.protocols.doh2 option to be enabled, which is the default in 8.x releases. It was published on September 20, 2026, and carries a CVSS v3.1 base score of 9.4 (Critical) (Github Advisory).

The root cause is a type confusion flaw (CWE-843) in the SCAppLayerForceProtocolChange function within src/app-layer-detect-proto.c. When a flow undergoes an HTTP/1 → HTTP/2 upgrade and then a DoH2 protocol change is triggered in the same packet, SCAppLayerForceProtocolChange unconditionally overwrites alproto_orig with the current alproto before the HTTP1 state has been freed. This causes the engine to later execute HTTP2 state cleanup code against an HTTP1 state object — a classic type confusion leading to an invalid free. The fix, introduced in commit e574009, adds a FlowChangeProto() check so that alproto_orig is only updated when no protocol change is already in progress, preserving the correct state type for cleanup (Suricata Commit, Github Advisory). The attack vector is network-based, requires no authentication or user interaction, and is automatable.

Successful exploitation can crash the Suricata process via an invalid free, disabling intrusion detection and prevention (IDS/IPS) capabilities and leaving monitored networks blind to ongoing attacks. The CVSS scoring also reflects high confidentiality and integrity impact, suggesting that memory corruption from the invalid free could theoretically be leveraged for further exploitation beyond denial of service, though the primary confirmed impact is process termination. Organizations relying on Suricata as a network security monitoring layer are at risk of losing visibility into network traffic during an attack (Github Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The vulnerability is automatable and requires no privileges or user interaction, making it straightforward to trigger remotely against any Suricata 8.x deployment with DoH2 enabled (the default). The EPSS score is approximately 0.40–0.54%, placing it in the 43rd percentile for exploitation likelihood within 30 days. No threat actor attribution or CISA KEV catalog listing has been reported (Github Advisory).

1. Reconnaissance: Identify network segments or hosts where Suricata 8.0.0–8.0.6 is deployed as an IDS/IPS sensor, particularly those with DoH2 inspection enabled (default in 8.x).
2. Craft malicious packet: Construct a single network packet that initiates an HTTP/1 to HTTP/2 upgrade request (via the Upgrade: h2c header) while simultaneously embedding a DoH2 (DNS over HTTPS) query payload.
3. Send the packet: Transmit the crafted packet through the network segment monitored by the vulnerable Suricata instance, targeting any host that Suricata is inspecting traffic for.
4. Trigger type confusion: Suricata processes the packet and calls SCAppLayerForceProtocolChange to switch the flow's application-layer protocol to DoH2, incorrectly overwriting alproto_orig before the HTTP1 state is freed.
5. Cause invalid free: When Suricata subsequently cleans up the flow, it executes HTTP2 state cleanup code against the HTTP1 state object, triggering an invalid free and crashing the Suricata process.
6. Achieve objective: The Suricata sensor crashes, disabling IDS/IPS monitoring and allowing subsequent malicious traffic to pass undetected (Suricata Commit, Github Advisory).

• Process: Unexpected termination or crash of the suricata process; core dump files generated in the Suricata working directory following processing of DoH2/HTTP upgrade traffic.
• Logs: Suricata error logs (/var/log/suricata/suricata.log) showing memory corruption errors, segmentation faults, or abort signals related to app-layer protocol state cleanup; log entries referencing SCAppLayerForceProtocolChange or alproto_orig.
• Network: Unusual HTTP/1 requests containing Upgrade: h2c headers combined with DNS query payloads (DoH format) directed at monitored hosts; repeated connection attempts from the same source following Suricata restarts.
• File System: Presence of core dump files (e.g., core, suricata.core) in the Suricata installation or working directory timestamped around the time of suspected exploitation.

Upgrade Suricata to version 8.0.7 or later, which contains the fix in commit e574009 (Suricata Commit, Github Advisory). As an interim workaround for deployments that cannot immediately upgrade, disable DoH2 protocol inspection by setting app-layer.protocols.doh2: no in the Suricata configuration file (suricata.yaml) and restarting the service. Note that disabling DoH2 will prevent Suricata from inspecting DNS-over-HTTPS/2 traffic, which may reduce detection coverage.

The vulnerability received coverage from security news outlets including The Hacker Wire and Forkast News, with the latter framing it alongside a related Suricata flaw (CVE-2026-94084) as critical issues that could blind network monitoring infrastructure (Forkast News). Community discussion appeared on Reddit's r/pwnhub CVE daily briefs and on Mastodon and Bluesky security feeds. Tenable published Nessus detection plugins (IDs 348344 and 350171) for the vulnerability, indicating prompt uptake by the vulnerability management community (Tenable).