Suricata 8.0.7 Addresses Critical HTTP/2 and DoH2 Flaws Blinding Network Security

The Open Information Security Foundation (OISF) released Suricata 8.0.7 to remediate two critical security vulnerabilities—CVE-2026-94084 and CVE-2026-94083—both carrying a CVSS score of 9.4. The first vulnerability, CVE-2026-94084, is a use-after-free defect in the Http2ThreadMultiBuf component triggered when inspecting HTTP/2 traffic against specific response header rules. The second flaw, CVE-2026-94083, stems from a type confusion error in the DNS-over-HTTPS/2 (DoH2) parser, where an HTTP/1-to-HTTP/2 upgrade induces cleanup routines to execute against an mismatched state. Why this matters: In enterprise cloud and perimeter architectures, network detection and response (NDR) and IDS/IPS engines serve as the foundational telemetry layer for identifying web application exploits, lateral movement, and data exfiltration. Because both vulnerabilities can be triggered remotely without authentication, malicious actors can purposefully crash monitoring daemon processes before launching targeted payload attacks against backend web services. When the monitoring system silently dies, secondary defensive automation like automated rate limiting or WAF-to-IDS correlation engines lose signal, leaving modern applications exposed. Context: This development reflects a widening challenge across modern application security: protocol complexity versus inspection engine memory safety. As web applications adopt higher-order protocols like HTTP/2, HTTP/3, and encrypted DNS natively, security inspection appliances must manage state transitions and complex buffer allocations in real time. Historical incidents in protocol parsing engines demonstrate that network inspection layers frequently become primary targets for denial-of-service evasion tactics. When parsers written in memory-unsafe paradigms process highly concurrent, multiplexed streams, parser drift directly translates into infrastructure-wide blind spots. What it means in practice: Engineering and SecOps teams running Suricata clusters must prioritize upgrading to version 8.0.7 immediately. Where instant upgrades are delayed by deployment windows, teams should evaluate temporarily disabling DoH2 parsing (`app-layer.protocols.doh2`) if out-of-band DNS filtering is covered elsewhere, or audit active HTTP/2 rulesets involving multi-buffer transforms. Long term, platform teams should ensure that critical inspection daemons run under strict process supervisor monitoring (such as systemd watchdog integrations or Kubernetes restart controllers) with active alerting on unexpected process termination, ensuring security controls cannot fail silently unnoticed.