Executive brief
Suricata, an open-source network threat detection engine used to monitor and filter traffic on corporate networks, contains a memory corruption flaw in its DNS over HTTPS/2 (DoH2) handler. When a client sends a DoH2 upgrade request during an HTTP/1 to HTTP/2 connection upgrade, the cleanup code incorrectly frees the wrong protocol state, causing a crash or potential code execution. The vulnerability affects default configurations in Suricata 8.x.
Technical details
Type confusion in DoH2 protocol upgrade handling occurs when SCAppLayerForceProtocolChange fails to account for in-progress HTTP1-to-HTTP2 state transitions, causing the HTTP1 state to be freed prematurely before the HTTP2 cleanup runs. The vulnerability is triggered by network-supplied packets sent to a Suricata IDS/IPS instance with DoH2 support enabled (default in 8.x) and requires no authentication. Successful exploitation can lead to invalid memory free, process crash, or remote code execution depending on memory layout.
Affected products
- OISF Suricata before 8.0.7
Timeline
- 2026-09-20: disclosed
- 2026-09-15: patched