A critical type confusion vulnerability in Suricata versions 8.0.0 through 8.0.6 allows unauthenticated attackers to cause memory corruption and potential system compromise.

The vulnerability is a type confusion flaw (CWE-843) occurring within the DoH2 protocol handling. An unauthenticated attacker can exploit this when the app-layer.protocols.doh2 feature is enabled, which is the default configuration in the 8.x branch, by sending a specially crafted request that triggers an invalid memory free during protocol state transitions.

The vulnerability carries a CVSS score of 9.4, reflecting its high potential for severe impact. Because Suricata is often deployed as a security appliance at the network perimeter, successful exploitation could grant an attacker full control over the monitoring infrastructure, leading to data exfiltration, unauthorized network visibility, or the bypass of critical security controls.

Immediate Action: Upgrade OISF Suricata to version 8.0.7 or later immediately to apply the patch for the DoH2 state management issue.

Proactive Monitoring: Monitor network traffic for anomalous DoH2 request patterns and review system logs for signs of service crashes or unauthorized process execution.

Compensating Controls: If patching is not immediately feasible, disable the app-layer.protocols.doh2 feature in the Suricata configuration to eliminate the vulnerable attack surface.

Public Exploit Available: No

Given the critical CVSS severity and the nature of the software as a primary security defensive tool, this vulnerability represents a significant risk to the integrity of the network. Administrators must prioritize updating to Suricata 8.0.7 to ensure that the memory management logic is corrected and to prevent potential remote code execution by unauthenticated network actors.