Wind River Support Network

HomeDefectsLIN1022-39820

Acknowledged

LIN1022-39820 : Security Advisory - suricata - CVE-2026-94083

Created: Oct 23, 2026 Updated: Oct 27, 2026

Resolved Date: Oct 23, 2026

Found In Version: 10.22.33.2

Severity: Standard

Applicable for: Wind River Linux LTS 22

Component/s: Userspace

Description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Data source: MITRE (cve@mitre.org)