Out-of-bounds read in Suricata - #VU162665
Published: November 9, 2026
Vulnerability identifier: #VU162665
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash Suricata and cause a denial of service.
The vulnerability exists due to type confusion in Suricata's DNS inspection of crafted DNS-over-HTTP/2 (DoH2) traffic, resulting in an out-of-bounds read. An unauthenticated remote attacker can submit specially crafted DoH2 traffic for inspection to trigger the crash when DoH2 parsing is enabled and DNS detection is running.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7