This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — CVE-2026-94083 and CVE-2026-94084 were published on 20 September 2026 for Suricata versions before 8.0.7. Both are rated Critical at CVSS 9.4 with a network attack vector, no privileges, and no user interaction. OISF shipped 8.0.7 on 15 September as a security release and said it addressed the largest number of vulnerability reports in the project's history. The public records do not report active exploitation.
ONE BUG CONFUSES PROTOCOL STATE — CVE-2026-94083 arises when a DNS-over-HTTP/2 request performs an HTTP/1-to-HTTP/2 upgrade in one packet. Suricata can retain HTTP/1 state but later run HTTP/2 cleanup against it, producing an invalid free. The path requires app-layer.protocols.doh2, which the advisory says is enabled by default in Suricata 8.x. The fix makes the protocol change explicit and adds a regression test for the single-packet upgrade.
THE OTHER BUG DEPENDS ON RULE SHAPE — CVE-2026-94084 is a use-after-free in Suricata's HTTP/2 inspection buffers. It can occur when the same transaction is evaluated by http.response_header rules both with and without a transform: one inspection path freed and rebuilt buffers that a later check could still reference. The patch reuses the existing buffers instead of replacing their allocations. That makes deployed rule composition—not merely whether HTTP/2 parsing is enabled—part of exposure analysis.
A SECURITY CONTROL IS STILL AN ATTACK SURFACE — Suricata sits where untrusted traffic is deliberately decoded, normalized, and matched against rules. A malformed flow can therefore target the inspection engine before the engine decides whether the traffic is malicious. OISF says its Critical rating is reserved for default Tier 1 features involving remotely triggerable, traffic-based code execution; the CVE records establish memory corruption and critical severity, but they do not establish exploitation in the wild. Defenders should treat the upgrade as urgent without presenting exploitation as confirmed.
WHAT TO CHECK — Inventory every Suricata sensor and confirm the running binary—not just the installed package—reports 8.0.7 or later. Prioritize inline IPS and internet-edge sensors, then identify 8.x deployments with DoH2 enabled and rule sets that combine transformed and untransformed http.response_header inspection. Restart upgraded services, verify packet capture and alerting recovered normally, and review crash, restart, core-dump, and watchdog events for unexplained failures around HTTP/2 traffic. Suricata 7 is now end of life, so move those sensors onto the supported 8.x branch rather than waiting for a 7.x fix.