CVE-2026-94083

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Sep 20, 2026, 1:18:05 AM UTC

Updated

Sep 20, 2026, 2:16:53 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.54% · Oct 25, 2026

A flaw was found in Suricata's DNS over HTTPS 2 (DoH2) application-layer protocol parser. When processing a DoH2 request accompanied by an HTTP/1 to HTTP/2 upgrade, Suricata mistakenly executes HTTP/2 state cleanup logic while the protocol handler is in an HTTP/1 state. A remote, unauthenticated attacker can exploit this type confusion by sending crafted protocol upgrade traffic to trigger an invalid memory free. This can result in a daemon crash leading to Denial of Service (DoS) or potentially arbitrary code execution within the privileges of the Suricata process. This issue affects Suricata versions prior to 8.0.7 when `app-layer.protocols.doh2` is enabled. A flaw was found in Suricata's DNS over HTTPS 2 (DoH2) application-layer protocol handler. When processing a DoH2 request accompanied by an HTTP/1 to HTTP/2 connection upgrade, Suricata incorrectly executes HTTP/2 state cleanup logic while in an HTTP/1 state. This type confusion triggers an invalid memory free, which a remote, unauthenticated attacker can exploit by sending crafted protocol upgrade traffic to crash the Suricata daemon or potentially execute arbitrary code with the privileges of the Suricata process. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.