CVE-2026-94083

Executive Summary

CVE-2026-94083 is a type confusion vulnerability in the Suricata intrusion detection/prevention system (IDS/IPS) affecting versions before 8.0.7, where HTTP/2 cleanup code is incorrectly executed against HTTP/1 state during a DoH2 (DNS-over-HTTPS) request that involves an HTTP/1-to-HTTP/2 upgrade. This mismatch causes an invalid free (memory corruption), rated CVSS 9.4 (Critical) with network attack vector, no privileges or user interaction required, and High confidentiality/integrity impact. Any organization running Suricata 8.x with the default-enabled app-layer.protocols.doh2 parser in an inline or passive inspection path is exposed; successful exploitation can crash the sensor (denial of inspection) or, in worst-case memory-corruption outcomes, enable code execution within the Suricata process context.

Technical Analysis

Suricata is a network security monitoring engine that reassembles and parses application-layer protocols for signature- and anomaly-based detection. In 8.x, the DoH2 (DNS-over-HTTPS version 2) application-layer parser is enabled by default (app-layer.protocols.doh2), meaning the engine will process DoH traffic observed on inspected network segments. The DoH2 parser builds on Suricata's HTTP/2 protocol state machinery.

The vulnerability is a type confusion (CWE-843): the code path responsible for tearing down/cleaning up HTTP/2 protocol state is invoked in a situation where the actual, instantiated protocol state object is HTTP/1. This occurs specifically when a DoH2 request is received in a connection that upgrades from HTTP/1 to HTTP/2. During cleanup, the engine treats the HTTP/1 state structure as if it were the HTTP/2 structure — leading to a dereference of fields at mismatched offsets and, as a direct consequence, an invalid free.

Two aspects make this significant:

1. The root cause is a state-machine/upgrade-handling flaw, not a parser input-parsing overflow — the corruption is triggered by the lifecycle of the connection (upgrade + teardown), not by malformed payload bytes alone.
2. The invalid free occurs in cleanup code, meaning it may be triggered on connection close or protocol-state transition rather than immediately during parsing. This complicates detection because the crash point may not correspond to the attacker's triggering packet.

The attack surface is the network-facing application-layer parsing engine. Because Suricata is typically deployed as an inline IPS/IDS on network boundaries or as a monitoring sensor, the flaw is reachable by any host that can generate a DoH2 request with an HTTP/1-to-HTTP/2 upgrade to a monitored endpoint. No authentication is required (PR:N) and no user interaction is required (UI:N). Severity is driven by High confidentiality and integrity impact (C:H/I:H), consistent with a memory-corruption primitive that could leak or alter memory; availability is rated A:L, which aligns with the fact that a controlled invalid free may crash the process but does not inherently guarantee repeated, total service outage on first attempt. The scope is Unchanged (S:U) — the affected security authority is the Suricata process itself.

Note on technical detail: The NVD description does not disclose the specific function, struct, or file involved. This report deliberately avoids naming internal Suricata functions or data structures, as none are provided in the source data.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template has been identified. The attack chain below is inferred at the vulnerability-class level from the NVD description and should be treated as a hypothesis for defensive planning, not a validated exploit.

1. Reconnaissance / target identification. An adversary identifies network segments or hosts that are inspected by a Suricata 8.x sensor with the default DoH2 parser enabled. Because app-layer.protocols.doh2 is on by default in 8.x, any inline Suricata 8.x deployment in front of a DNS-over-HTTPS service (or inspecting generic DoH traffic) is potentially in scope. Shodan-style recon can locate exposed Suricata management interfaces (e.g., Kibana/Suricata dashboards) to fingerprint version-bearing deployments.

2. Triggering the type confusion. The attacker crafts or induces a connection that begins as HTTP/1 and upgrades to HTTP/2, then carries a DoH2 request. The critical property is the combination: an HTTP/1-to-HTTP/2 upgrade in conjunction with a DoH2 request, such that the state object being torn down is HTTP/1 while the cleanup path assumes HTTP/2.

3. Invalid free. On transition/cleanup of that connection's protocol state, the HTTP/2 cleanup routine is applied to HTTP/1 state. The mismatched structure interpretation causes an invalid free — a memory-management fault in the Suricata process.

4. Post-exploitation impact. The immediate observable outcome is a crash or corruption of the Suricata sensor process, causing loss of inspection coverage (a detection/availability impact). Under adverse memory-corruption conditions, an invalid free can be leveraged toward further memory corruption and, in the worst case, code execution in the Suricata process context — consistent with the High C/I and Low A scoring. No verified exploitation of either outcome exists publicly.

Caveats: No public PoC is available; the precise packet sequence, required HTTP/2 upgrade semantics, and reliability of the invalid free are not documented in the provided data. Defenders should assume the flaw is triggerable by a crafted network flow but must validate against their own lab before treating any specific packet pattern as confirmed.

Impact Assessment

• Confidentiality (C: High): A memory-corruption/invalid-free primitive in a security sensor could, in the worst case, expose in-process memory. Sensors often hold packet buffers, configuration, and telemetry.
• Integrity (I: High): Invalid free and subsequent heap corruption can alter process memory state.
• Availability (A: Low): The most probable first-order effect is a crash of the Suricata process. Because Suricata is frequently deployed inline, a crash can create a gap in detection or, depending on fail-mode configuration, disrupt inspected traffic paths.
• Blast radius: The affected asset is the Suricata sensor itself (scope Unchanged). However, the downstream impact is broad: a compromised or crashed IDS/IPS can blind an entire monitored network segment, and in inline deployments may affect traffic availability for every inspected link.
• Who is affected: Organizations running Suricata 8.x prior to 8.0.7 with default DoH2 parsing — notably network security operations teams, ISPs, and enterprises using Suricata inline at perimeters, DMZs, or cloud egress points.
• Exploitability context: AV:N/AC:L/PR:N/UI:N yields a trivial barrier to attempting the trigger; the uncertainty lies in the reliability of the invalid free and any path to code execution. CISA KEV listing: No. EPSS: not yet scored (do not treat as low risk by default — absence of EPSS simply reflects a lack of FIRST.org scoring at analysis time).

Detection Guidance

Detection for this issue is difficult because the corruption occurs in cleanup code and may not produce distinctive network payloads. The pragmatic approach combines network-side detection of the trigger pattern (DoH2 + HTTP/1→HTTP/2 upgrade on the same connection) with host/process-side detection of Suricata crash or abnormal termination.

Sigma Rule

title: Suricata Process Crash or Invalid Free Indicators (CVE-2026-94083)
id: 8f2c1a44-9408-3d1e-9c7b-26b0c9408300
status: experimental
description: Detects abnormal termination or crash of the Suricata engine potentially linked to the DoH2 HTTP/1 to HTTP/2 type confusion invalid free (CVE-2026-94083).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94083
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_process:
    - 'suricata'
  selection_message:
    - 'invalid free'
    - 'free(): invalid pointer'
    - 'double free'
    - 'corrupt'
    - 'segfault'
    - 'signal 11'
    - 'HTTP2'
  condition: selection_process and selection_message
falsepositives:
  - Legitimate OOM-killer or unrelated segfaults in a multi-purpose host
level: high
tags:
  - attack.t1190
  - cve.2026.94083

YARA Rule

rule CVE_2026_94083_Suricata_DoH2_TypeConfusion
{
    meta:
        author = "valtersit.com"
        description = "Detects references to the DoH2/HTTP2 state cleanup type confusion in Suricata binaries and logs (CVE-2026-94083)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94083"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $s1 = "doh2" ascii nocase
        $s2 = "http2" ascii nocase
        $s3 = "HTTP2" ascii
        $s4 = "invalid free" ascii nocase
        $s5 = "upgrade" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (2 of them)
}

Note: This YARA rule is a low-fidelity heuristic intended to flag files or logs that reference the vulnerable DoH2/HTTP2 code paths. It is not a memory-scanning signature for the corruption itself.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94083 Suricata DoH2 HTTP1-to-HTTP2 Upgrade Trigger Attempt"; flow:established,to_server; http.protocol; content:"HTTP/1.1"; http.header; content:"Upgrade"; nocase; http.header; content:"h2c"; nocase; content:"application/dns-message"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:9408301; rev:1;)

This rule targets the trigger preconditions (HTTP/1.1 connection requesting an h2c upgrade while carrying DNS-message content) rather than the memory-fault symptom, which is not observable on the wire. Tune to the specific DoH2 endpoints in scope.

Elastic Detection

process where event.type == "end" and process.name == "suricata" and
  (process.exit_code != 0 or process.exit_code != null) and
  not process.args : ("--build-info", "--list-keywords")

Pair with a companion host log query looking for "invalid free", "free(): invalid pointer", or SIGSEGV in syslog/journald for the suricata unit. The EQL above flags unexpected abnormal termination of the Suricata process.

Splunk SPL Query

index=os sourcetype=syslog ("suricata" AND ("invalid free" OR "free(): invalid pointer" OR "double free" OR "SIGSEGV" OR "signal 11" OR "HTTP2" OR "doh2"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Alternatively, if network flow/HTTP logs are ingested:

index=proxy OR index=zeek sourcetype=*http*
| search http.request.method=CONNECT OR http.request.headers{}.Upgrade="h2c"
| search url="*/dns-query*" OR http.request.headers{}.Content_Type="application/dns-message"
| stats count by src, dest, host

Wazuh OSSEC Rule

<group name="suricata,cve-2026-94083,">
  <rule id="940830" level="12">
    <decoded_as>syslog</decoded_as>
    <match>suricata</match>
    <regex>invalid free|free\(\): invalid pointer|double free|SIGSEGV|signal 11|HTTP2|doh2</regex>
    <description>CVE-2026-94083: Possible Suricata DoH2 HTTP2 state type confusion / invalid free detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94083,</group>
  </rule>

  <rule id="940831" level="10">
    <if_group>suricata</if_group>
    <match>segfault</match>
    <description>CVE-2026-94083: Suricata process segfaulted, possible DoH2 type confusion crash</description>
    <group>cve_2026_94083,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked source; the NVD description references version 8.0.7 as the fixed release, but no vendor advisory, changelog entry, or commit hash was cited. Treat all versions below 8.0.7 as unpatched until a vendor advisory is independently confirmed.

1. Immediate mitigations

   • Disable the DoH2 parser. Set app-layer.protocols.doh2: no (or equivalent YAML) in suricata.yaml and restart the engine. The NVD description states the vulnerability requires DoH2 to be enabled; disabling it removes the reachable trigger. This is the highest-confidence mitigation given available information.
   • Reduce exposure of inline deployments. Where inline IPS is not strictly required, run Suricata in IDS (passive) mode to limit the impact of a process crash on inspected traffic.
   • Harden process supervision. Run Suricata under a supervisor (systemd with Restart=always, or equivalent) to auto-recover from crashes and preserve telemetry of repeated faults.

2. Patch / upgrade steps

   • Upgrade to Suricata 8.0.7 or later as referenced in the NVD description. Before rolling to production, verify the release via the official Suricata distribution channel (OISF) and confirm the fix note addresses DoH2/HTTP2 state cleanup.
   • Validate in a staging environment using attacker-controlled DoH2-with-upgrade traffic to confirm the invalid free no longer triggers.
   • Inventory first: enumerate all Suricata 8.x instances (including container images and cloud-native network sensors) to avoid leaving unmanaged sensors unpatched.

3. Long-term hardening

   • Minimize enabled app-layer parsers to those operationally required; each enabled protocol expands the attack surface.
   • Track Suricata releases via the OISF security mailing list and subscribe to NVD feeds filtered on cpe:2.3:a:oisf:suricata.
   • Instrument crash telemetry (core dumps, systemd-coredump, kernel segfault logs) and alert on any Suricata abnormal termination, since this vulnerability's primary symptom is a crash.
   • Apply network segmentation so that arbitrary hosts cannot reach monitored segments with crafted upgrade/DoH traffic.
   • Re-enable DoH2 only after upgrading to a verified-patched release and confirm the fix in a controlled test.

References

1. NVD — CVE-2026-94083: https://nvd.nist.gov/vuln/detail/CVE-2026-94083
2. OISF / Suricata official project: https://suricata.io/ (verify the 8.0.7 release and any DoH2 advisory directly with the vendor)
3. Suricata documentation — application-layer protocol configuration (app-layer.protocols.doh2): https://docs.suricata.io/
4. CWE-843 — Type Confusion: https://cwe.mitre.org/data/definitions/843.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild / campaign status: No CISA KEV listing, no public PoC, no Nuclei template, and no exploit code were identified for CVE-2026-94083 at the time of this report. EPSS has not yet been assigned by FIRST.org. No threat actor campaigns are attributable to this CVE based on available data. Given a critical CVSS (9.4) and an unpatched state, continuous monitoring for emerging exploit activity is recommended.