CVE-2026-94083
Quick assessment
Affected
OISF Suricata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Suricata 在 8.0.7 之前版本中存在一个 DoH2（DNS over HTTP/2）类型混淆漏洞，可能导致无效的内存释放（invalid free）。原因是：当出现一个 DoH2 请求中伴随 HTTP/1 到 HTTP/2 升级时，尽管实际状态为 HTTP/1，但清理 HTTP/2 状态的代码仍会被执行。该问题需要启用 协议（在 8.x 版本中默认启用）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94083
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-94083
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94083
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-94083 (1)
Other References for CVE-2026-94083 (1)
Other References for CVE-2026-94083 (1)
IV. Related Vulnerabilities
Same product: Suricata
-
CVE-2026-94084
Suricata 8.0.7前Http2ThreadMultiBuf释放后使用漏洞 -
CVE-2026-71855
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow -
CVE-2026-71418
Suricata doh2: crafted HTTP/2 DATA frames can cause quadrati -
CVE-2026-57223
Suricata windows: unquoted LocalSystem service ImagePath can -
CVE-2026-63446
Suricata app-layer: passed flows can retain transactions, ca
Same vendor: OISF
-
CVE-2026-94084
Suricata 8.0.7前Http2ThreadMultiBuf释放后使用漏洞 -
CVE-2026-71855
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow -
CVE-2026-71418
Suricata doh2: crafted HTTP/2 DATA frames can cause quadrati -
CVE-2026-57223
Suricata windows: unquoted LocalSystem service ImagePath can -
CVE-2026-63446
Suricata app-layer: passed flows can retain transactions, ca
V. Comments for CVE-2026-94083
No comments yet