CVE-2026-94083Patch(oisf / suricata)

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch oisf suricata systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

oisf CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074

Other references

Weakness type (CWE)

CWE-843

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

suricata

Threat summary

Patch or workaround signal is available
8 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 7 signals
Technical details provided in 7 signals
Disclosure: 1 classified signal
Peaked 3d ago at 3 mentions (2026-09-20); latest day: 1
8 total mentions across 4 days

Affected systems

Vendors

oisf

Products

suricata

Deep dive

Activity timeline8 mentions / 4d

Signal classification2 categories

Patch

787.5%

Disclosure

112.5%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	3	Patch3
2026-09-21	3	Disclosure1Patch2
2026-09-22	1	Patch1
2026-10-27	1	Patch1

Full discourse8 posts

Dark Web Intelligence@DailyDarkWeb46d
Patch
🚨 TWO CRITICAL SURICATA FLAWS DISCLOSED — CRAFTED TRAFFIC CAN CRASH THE IDS/IPS Two newly assigned critical vulnerabilities in Suricata 8.x expose the network-monitoring engine itself to unauthenticated, network-triggered memory corruption. • CVE-2026-94083 — CVSS 9.4 — DoH2 type confusion / invalid free • CVE-2026-94084 — CVSS 9.4 — HTTP/2 use-after-free • Both affect Suricata versions before 8.0.7 • CVE-2026-94083 requires app-layer.protocols.doh2, which is enabled by default in Suricata 8.x • Crafted traffic can trigger memory corruption and crash the Suricata process, potentially creating a monitoring blind spot • No public PoC or confirmed in-the-wild exploitation has been identified at this time • Fixed in Suricata 8.0.7 ⚠️ Analyst Note: The unusual security angle is that an attacker can target the defensive sensor using traffic the sensor is supposed to inspect. A successful crash could temporarily remove IDS/IPS visibility while subsequent malicious activity crosses the monitored segment. Suricata 8.0.7 is a broader security release addressing the project's highest number of vulnerability reports to date. OISF says the increase was partly driven by AI-assisted security analysis. Original OISF release: https://suricata.io/2026/09/15/suricata-8-0-7-released/ #Suricata #IDS #IPS #Vulnerability #CyberSecurity #ThreatIntel #DDW #DarkWeb
Post summary
The tweet discloses two critical Suricata CVEs and states they are fixed in version 8.0.7, with no public PoC or confirmed active exploitation.
021856.8K
209.0K followersView on X
VulnTracker@vuln_tracker45d
Patch
Suricata's HTTP2 engine had two critical memory-safety bugs at once both fixed in a single release. CVE-2026-94083 is a DoH2 type confusion causing an invalid free. CVE-2026-94084 is a separate Http2ThreadMultiBuf use-after-free triggered by http.response_header rules. Both are rated 9.4 and both affect Suricata before 8.0.7. One update closes both. Update now. Details: http://vulntracker.io/cves/CVE-2026-94083 #Suricata #CVE #IDS #InfoSec #CyberSecurity
Post summary
Suricata resolved two critical memory-safety flaws (CVE-2026-94083 and CVE-2026-94084, both CVSS 9.4) in version 8.0.7, with an explicit directive to update immediately.
00050298
832 followersView on X
VulnTracker@vuln_tracker46d
Patch
A default-enabled Suricata feature can crash your IDS with a single crafted connection (CVSS 9.4). CVE-2026-94083 is a type confusion in Suricata's DoH2 handling when a DoH2 request rides an HTTP1-to-HTTP2 upgrade, the wrong cleanup code runs and triggers an invalid free. DoH2 is enabled by default in Suricata 8.x. Fixed in Suricata 8.0.7. Update now. Details: http://vulntracker.io/cves/CVE-2026-94083 #Suricata #CVE #IDS #InfoSec #CyberSecurity
Post summary
The post describes a Suricata DoH2 type confusion causing crashes and notes the vulnerability is fixed in Suricata 8.0.7 with an explicit update recommendation.
00041264
832 followersView on X
CCB Alert@CCBalert44d
Patch
Warning: Critical vulnerabilities affecting #Suricata. CVE-2026-94083 (CVSS: 9.4) allows an attacker to trigger a DoS. CVE-2026-94084 (CVSS: 9.4) allows an attacker to conduct DoS or execute arbitrary code due to memory corruption #RCE! #Patch #Patch #Patch
Post summary
Critical vulnerabilities in #Suricata (CVE-2026-94083 and CVE-2026-94084) with CVSS 9.4 are highlighted, with a strong emphasis on patching via repeated '#Patch' hashtags, though specific remediation steps are not listed.
01011301
7.3K followersView on X
Hugo | DevOps | Cybersecurity@HugoValters9d
Patch
CVE-2026-94083: type confusion in Suricata's DoH2 handling can trigger an invalid free via HTTP1-to-HTTP2 upgrade, CVSS 9.4. Patch to 8.0.7 now. #CVE #infosec #Suricata https://www.valtersit.com/cve/CVE-2026-94083/ #Oisf #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post discloses a critical type confusion vulnerability in Suricata (CVE-2026-94083, CVSS 9.4) and explicitly urges users to patch to version 8.0.7.
0000047
1.1K followersView on X
CERT-PY@CERTpy45d
Disclosure
⚠️ Vulnerabilidades en productos Suricata ❗ CVE-2026-94084 ❗ CVE-2026-94083 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-suricata-2/ https://t.co/yzkl6XTGV1
Post summary
The tweet announces two CVEs affecting Suricata products and provides a link for further information, without mentioning PoC, exploit, active exploitation, patches, or technical details.
00000234
6.7K followersView on X
Anthony Bahn@HoustonIntrove145d
Patch
Your IDS can blind itself. Suricata before 8.0.7 frees the wrong state on DoH2 (CVE-2026-94083, CVSS 9.4). One crafted HTTP1-to-HTTP2 upgrade and the sensor crashes while traffic keeps flowing. Jump to 8.0.7, or turn doh2 off until you can.
Post summary
Suricata DoH2 use-after-free (CVE-2026-94083, CVSS 9.4) crashes sensor via crafted HTTP/1-to-HTTP/2 upgrade; remediation is upgrade to 8.0.7 or disable DoH2.
0000030
37 followersView on X
ADK Cyber@ADKCyber46d
Patch
CVE-2026-94083 (CVSS 9.4): Suricata < 8.0.7 vulnerable to invalid free via DoH2 handling. Upgrade to 8.0.7 if using for detection. https://nvd.nist.gov/vuln/detail/CVE-2026-94083 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/1SFetGvc0T
Post summary
The post describes a high-severity CVE in Suricata involving an invalid free via DoH2 handling and explicitly recommends upgrading to version 8.0.7. The primary actionable takeaway is the available patch.
0000034
97 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	oisf	suricata	-	-	-

Explore more

Back to dashboard oisf CVEs suricata vulnerabilities

What researchers are saying

CVE-2026-94083

Dark Web Intelligence[verified]@DailyDarkWebPatch

The tweet discloses two critical Suricata CVEs and states they are fixed in version 8.0.7, with no public PoC or confirmed active exploitation.

VulnTracker[verified]@vuln_trackerPatch

Suricata resolved two critical memory-safety flaws (CVE-2026-94083 and CVE-2026-94084, both CVSS 9.4) in version 8.0.7, with an explicit directive to update immediately.

VulnTracker[verified]@vuln_trackerPatch

The post describes a Suricata DoH2 type confusion causing crashes and notes the vulnerability is fixed in Suricata 8.0.7 with an explicit update recommendation.

Hugo | DevOps | Cybersecurity[verified]@HugoValtersPatch

The post discloses a critical type confusion vulnerability in Suricata (CVE-2026-94083, CVSS 9.4) and explicitly urges users to patch to version 8.0.7.

Anthony Bahn[verified]@HoustonIntrove1Patch

Suricata DoH2 use-after-free (CVE-2026-94083, CVSS 9.4) crashes sensor via crafted HTTP/1-to-HTTP/2 upgrade; remediation is upgrade to 8.0.7 or disable DoH2.

ADK Cyber[verified]@ADKCyberPatch

The post describes a high-severity CVE in Suricata involving an invalid free via DoH2 handling and explicitly recommends upgrading to version 8.0.7. The primary actionable takeaway is the available patch.

CCB Alert@CCBalertPatch

Critical vulnerabilities in #Suricata (CVE-2026-94083 and CVE-2026-94084) with CVSS 9.4 are highlighted, with a strong emphasis on patching via repeated '#Patch' hashtags, though specific remediation steps are not listed.

CERT-PY@CERTpyDisclosure

The tweet announces two CVEs affecting Suricata products and provides a link for further information, without mentioning PoC, exploit, active exploitation, patches, or technical details.