Description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-09-20T02:16:53.520Z",
  "pubdate": "2026-09-20T02:16:53.520Z",
  "executiveSummary": "Suricata versions prior to 8.0.7 contain a critical type confusion vulnerability within the DoH2 (DNS over HTTPS/2) implementation. The flaw occurs during the transition between HTTP1 and HTTP2 protocols when handling DoH2 requests, leading to an invalid memory free operation.\nThe vulnerability is triggered when the app-layer.protocols.doh2 module is enabled, which is the default configuration in all 8.x versions of Suricata. A remote, unauthenticated attacker can exploit this condition by crafting a specific HTTP1 to HTTP2 upgrade request, potentially leading to application instability, service disruption, or potentially remote code execution due to memory corruption.\nBecause Suricata operates as a deep packet inspection engine, this vulnerability poses a significant risk to network security infrastructure, as an attacker could induce a denial-of-service state to bypass monitoring or crash the security appliance entirely.\nSuccessful exploitation requires the attacker to have network visibility to the targeted Suricata instance and the ability to send specifically crafted packets to trigger the erroneous protocol state transition.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper state management logic during the protocol upgrade process within the Suricata application-layer processing engine. Specifically, when a DoH2 request initiates an upgrade from HTTP1 to HTTP2, the internal state machine fails to correctly transition or track the active protocol layer associated with the session.\nDuring the teardown or cleanup phase of the request, the application logic incorrectly assumes that the session state belongs to HTTP2 and executes the corresponding cleanup functions. Because the actual underlying state may still be categorized as HTTP1, this results in a type confusion. The cleanup routine attempts to free memory or deallocate resources that do not correspond to the actual allocated structure, or it accesses pointers that were initialized for a different protocol context.\nThis invalid free operation constitutes a memory management error that can lead to heap corruption. In many environments, triggering an invalid free on a pointer controlled or influenced by attacker-supplied data can allow for the corruption of heap metadata. If an attacker can successfully manipulate the heap layout, this vulnerability could be leveraged to gain arbitrary code execution, although the primary documented impact is system instability and crash.\nThe attack flow proceeds as follows: First, the attacker initiates a DoH2 request targeted at the Suricata-monitored network. Second, the attacker embeds an HTTP1 to HTTP2 upgrade header within the request to force the state machine into an inconsistent configuration. Third, the attacker concludes or terminates the request in a manner that triggers the cleanup routine for the HTTP2 layer. Fourth, the Suricata engine executes the HTTP2 cleanup logic on an HTTP1-formatted state structure, triggering the invalid free error.\nThis vulnerability is localized to the DoH2 processing module and is inherently exposed to any network traffic inspected by the engine. Since no authentication is required to send traffic to a network security appliance, the attack surface includes any remote entity capable of routing traffic through the target instance. The requirement for 'app-layer.protocols.doh2' to be enabled makes this a default-vulnerable condition for all Suricata 8.x deployments prior to the patch release."
}