# CVE-2026-94083

Suricata DoH2 type-confusion allows crash or potential RCE via HTTP1->HTTP2 upgrade

- Page: https://www.vulneraibility.com/cve/CVE-2026-94083
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.54% (percentile 45.6)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-843
- Published: 2026-09-20

## Affected versions

- OISF Suricata: affected >= 8.0.0 and < 8.0.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote memory corruption via crafted DoH2 (HTTP1->HTTP2 upgrade) can crash Suricata (DoS) or enable arbitrary code execution.

## Action

Immediate action required

## Recommendation

Upgrade to Suricata 8.0.7+ or disable app-layer.protocols.doh2 until patched

## References

- [other] https://forum.suricata.io/t/suricata-8-0-7-released/6467
- [other] https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074
- [other] https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.