CVE-2026-94084
published 2026-09-20CVE-2026-94084: Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a…
PriorityP349critical9.4CVSS 3.1
AVNACLPRNUINSUCHIHAL
EPSS
0.54%
44.6th percentile
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oisf | suricata | < 8.0.7 | 8.0.7 |
CVSS provenance
nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_redhat9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
ghsa_unreviewed·2026-09-20
CVE-2026-94084 [CRITICAL] CWE-416 Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
VulDB
OISF Suricata up to 8.0.6 Http2ThreadMultiBuf use after free
vuldb·2026-09-20
CVE-2026-94084 OISF Suricata up to 8.0.6 Http2ThreadMultiBuf use after free
A vulnerability has been found in OISF Suricata up to 8.0.6 and classified as very critical. Affected by this issue is some unknown functionality of the component Http2ThreadMultiBuf. Performing a manipulation results in use after free.
This vulnerability is identified as CVE-2026-94084. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
Red Hat
suricata: suricata: use-after-free in HTTP/2 response header inspection
vendor_redhat·2026-09-20·CVSS 9.4
CVE-2026-94084 [CRITICAL] CWE-416 suricata: suricata: use-after-free in HTTP/2 response header inspection
suricata: suricata: use-after-free in HTTP/2 response header inspection
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management (`Http2ThreadMultiBuf`). When inspected HTTP/2 response traffic triggers signature rules that evaluate the `http.response_header` keyword simultaneously with and without sticky buffer transformations, the HTTP/2 state handler improperly reuses allocated memory buffers. An unauthenticated remote attacker can exploit this flaw by transmitting crafted HTTP/2 server response frames across monitored network segments, leading to memory c
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [fedora-all]
bugzilla·2026-10-02·CVSS 9.4
CVE-2026-94084 [CRITICAL] CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [fedora-all]
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Bugzilla
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [epel-all]
bugzilla·2026-10-02·CVSS 9.4
CVE-2026-94084 [CRITICAL] CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [epel-all]
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Bugzilla
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection
bugzilla·2026-09-22·CVSS 9.4
CVE-2026-94084 [CRITICAL] CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection
CVE-2026-94084 suricata: suricata: use-after-free in HTTP/2 response header inspection
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
2026-09-20
Published