CVE-2026-94083 in Suricata
Summary
by MITRE • 09/20/2026
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified as CVE-2024-36597 represents a critical type confusion flaw within Suricata versions prior to release 8.0.7, specifically affecting its handling of DNS over HTTPS (DoH) traffic that attempts an upgrade to HTTP/2. This defect arises from a logical error in the application layer protocol state machine where cleanup routines designed for HTTP/2 are erroneously executed against data structures allocated and managed under HTTP/1 protocols. The root cause lies in the failure to properly validate the current protocol state before invoking deallocation functions, leading to an invalid free operation that can destabilize the intrusion detection system's memory management subsystem.
The technical mechanism of this flaw is triggered when a client initiates a DoH2 request and subsequently attempts to upgrade the connection from HTTP/1 to HTTP/2. In such scenarios, Suricata’s application layer engine may retain references or pointers associated with the initial HTTP/1 state while simultaneously processing headers indicative of an HTTP/2 transition. Because the cleanup code for the HTTP/2 state is executed regardless of whether the actual negotiated protocol version has fully stabilized as HTTP/2, the system attempts to free memory blocks that were not allocated according to HTTP/2 specifications or may have already been freed by earlier stages of processing. This mismatch between expected and actual object types constitutes a classic type confusion vulnerability, which falls under CWE-843: Accessing Memory with Incorrect Type Reference.
From an operational perspective, this invalid free condition poses significant risks to the stability and security of network monitoring infrastructure running affected versions of Suricata. An attacker capable of crafting specific DoH traffic patterns can exploit this flaw to trigger a segmentation fault or other memory corruption errors within the IDS/IPS process. Such exploitation could result in a denial of service by crashing the detection engine, thereby creating blind spots in network visibility and allowing malicious traffic to pass undetected. Furthermore, depending on the specific memory allocator behavior and surrounding context, invalid frees can sometimes be leveraged for more severe outcomes such as arbitrary code execution or information disclosure through heap corruption techniques, although the primary documented impact remains service disruption due to process termination.
The vulnerability is particularly relevant in environments where DoH2 inspection is enabled via the app-layer.protocols.doh2 configuration directive, which is set to active by default in Suricata 8.x releases. This widespread default configuration increases the attack surface for organizations relying on this feature for encrypted traffic analysis without realizing they are exposed to state machine inconsistencies during protocol upgrades. The flaw highlights the complexity of maintaining robust state tracking across multiple application layer protocols and underscores the necessity for rigorous validation checks before performing resource cleanup operations in high-performance network security appliances.
To mitigate this vulnerability, administrators must upgrade Suricata to version 8.0.7 or later, where the developers have implemented proper state verification logic to ensure that HTTP/2 specific cleanup routines are only invoked when the connection has successfully established an HTTP/2 session. Until upgrading is feasible, organizations may consider disabling DoH inspection if it is not strictly required for their security posture, although this reduces visibility into encrypted DNS traffic which is increasingly used by malware and command-and-control infrastructure. Continuous monitoring of Suricata logs for unexpected process restarts or segmentation faults can serve as an indicator that exploitation attempts are occurring against unpatched systems.
This incident aligns with broader industry concerns regarding the reliability of deep packet inspection engines when handling complex protocol transitions, a challenge often categorized under CWE-823: Use of Out-of-range Pointer Offset if memory corruption leads to arbitrary writes, or generally within the ATT&CK framework context related to Defense Evasion techniques that aim to disrupt security monitoring capabilities. By addressing this type confusion flaw through timely patching and configuration review, organizations can maintain the integrity of their intrusion detection systems and prevent potential service disruptions caused by malformed DoH traffic exploiting state management deficiencies in network analysis tools.