Suricata HTTP/2 Memory Safety Flaws

Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.

Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.