Suricata CVE-2026-94083

Requires app-layer.protocols.doh2 to be enabled, which is the DEFAULT in Suricata 8.x versions, so out-of-the-box 8.x sensors are exposed. Triggering requires a DoH2 request that performs an HTTP1-to-HTTP2 upgrade to traverse traffic that the Suricata sensor is inspecting; no authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the doh2 app-layer parser must be active (default-on in 8.x but may be disabled or absent in older/hardened configs), and Suricata must actually be inspecting the path the crafted DoH2 flow takes. Pre-8.x deployments without doh2 default-enabled are less likely to be affected in default configuration.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the triggering condition (app-layer.protocols.doh2) is enabled by default in Suricata 8.x - so default deployments are exposed. The core defect (CWE-843 type confusion producing an invalid free) is a memory-corruption primitive, confirmed by the vendor commit that adds a FlowChangeProto guard so HTTP2 cleanup no longer runs against an HTTP1 state. The most reliable real-world outcome is a crash of the IDS/IPS process, which for an inline sensor also degrades network monitoring/protection. The vendor rates C:H/I:H/A:L (9.4); the confidentiality/integrity 'High' ratings imply successful exploitation of the invalid free toward disclosure or code execution, which is plausible but not demonstrated - I would weight availability (A:H sensor crash) as the more certain impact. EPSS, CISA KEV, and public POC signals are all absent from the input, so there is no evidence of active exploitation or automated weaponization yet; treat this as a patch-urgently-before-it-is-weaponized case given the memory-corruption class and default-on config, rather than a confirmed in-the-wild threat.

An attacker sends (or coerces monitored hosts into generating) a DoH2 request that begins as HTTP/1.1 and negotiates an upgrade to HTTP/2 across a link inspected by a Suricata sensor. Suricata's app-layer detection changes protocol state but runs HTTP2 cleanup code against a still-HTTP1 state, triggering a type-confusion invalid free and corrupting memory or crashing the sensor. No public exploit is identified at time of analysis; exploitation requires no authentication and no user interaction, only that the crafted DoH2 traffic traverses the monitored network.