Overview
The Open Information Security Foundation (OISF) has released Suricata 8.0.7, a security update fixing two critical memory-corruption vulnerabilities in the widely deployed open-source IDS/IPS/network security monitoring engine: CVE-2026-94083 and CVE-2026-94084. Both carry a CVSS score of 9.4, are exploitable by unauthenticated attackers over the network, and can crash the Suricata process — meaning a single crafted packet stream can blind the very sensor tasked with watching that traffic.
Because both flaws sit in protocol parsers (DoH2 and HTTP/2) that process traffic Suricata is specifically designed to inspect, they represent the kind of "watcher's blind spot" risk that is especially dangerous: the security tool itself becomes the attack surface.
Technical Details
| Field | Value |
|---|---|
| CVE IDs | CVE-2026-94083, CVE-2026-94084 |
| Severity | Critical (CVSS 9.4, both) |
| Attack Vector | Network |
| Authentication | None required |
| Fixed In | Suricata 8.0.7 |
CVE-2026-94083 — DoH2 Type Confusion (Invalid Free)
Suricata versions before 8.0.7 mishandle state when a DNS-over-HTTPS/2 (DoH2) request attempts an HTTP/1-to-HTTP/2 protocol upgrade. Cleanup code written for the HTTP/2 state runs even though the connection's actual state is still HTTP/1, causing Suricata to free memory it should not — an invalid free that can crash the engine. Triggering this requires app-layer.protocols.doh2 to be enabled, which is the default setting across Suricata 8.x.
CVE-2026-94084 — Http2ThreadMultiBuf Use-After-Free
A use-after-free in Http2ThreadMultiBuf is triggered when a transaction is inspected by rules that use http.response_header, once with a transform applied and once without. The mismatched inspection paths lead to a buffer being freed and then referenced again, another crash-capable condition.
Impact Assessment
Why This Matters More Than a Typical DoS
A crashed Suricata process doesn't just cause downtime — depending on deployment mode, it can mean:
- IDS mode: monitoring gaps where malicious traffic passes uninspected until the process is restarted
- IPS/inline mode: a fail-open or fail-closed event that either drops legitimate traffic or, worse, allows all traffic through unfiltered while the engine restarts
- Repeated crash-loop attacks: an attacker who can reliably trigger the crash can keep a target's monitoring layer offline on demand, clearing a path for a separate, unrelated intrusion
Who Is At Risk
Any organization running Suricata 8.x for network intrusion detection or prevention, particularly with DoH2 inspection enabled — the default — is exposed to CVE-2026-94083. CVE-2026-94084 affects deployments using http.response_header rules with mixed transform usage, a common pattern in mature rule sets.
Mitigation
- Upgrade to Suricata 8.0.7 immediately. This is the only complete fix for both vulnerabilities.
- If immediate upgrade isn't possible, consider disabling
app-layer.protocols.doh2insuricata.yamlas a temporary risk reduction for CVE-2026-94083 — note this will stop DoH2 traffic inspection entirely. - Monitor for unexpected Suricata process restarts or crash-loop behavior as a possible indicator of active exploitation attempts.
- Ensure your deployment has automatic process supervision (systemd, container orchestration) configured with alerting on restart, so a crash doesn't silently degrade monitoring coverage.