← Back

CVE-2026-94083

nvd nist
Published: Sep 20, 2026Modified: Sep 28, 2026

JSON object

Loading...
9.4
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploitability: 3.9 / Impact: 5.5
Source: MITRE (Secondary)

Description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

Affected (1)

Products: Oisf: Suricata
Oisf
1 product
Suricata
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Suricata
version < 8.0.7

Related CWEs

CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (3)

Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Release Notes

Timeline

No history available yet.