September 21, 2026
- Two critical Suricata 8.x flaws let crafted traffic crash the IDS/IPS itself: CVE-2026-94083 (CVSS 9.4, DoH2 type confusion / invalid free) and CVE-2026-94084 (9.4, HTTP/2 use-after-free), both unauthenticated and network-triggerable, fixed in 8.0.7. The DoH2 path is enabled by default in 8.x. OISF notes this is its highest-ever count of vulnerability reports in one release, attributing the spike to AI-assisted analysis, and that Suricata 7 is now EOL (OISF). · Vulnerabilities & Exploits