Executive Summary

A critical vulnerability, CVE-2026-94084, has been identified in Suricata, an open-source network intrusion detection and prevention system. This vulnerability affects Suricata versions before 8.0.7 and has a CVSS score of 9.4, indicating a critical severity level. The vulnerability is caused by a use-after-free error in the Http2ThreadMultiBuf when transactions are inspected by rules that use http.response_header with and without a transform.

Technical Analysis

The vulnerability class of CVE-2026-94084 is a use-after-free vulnerability. The attack vector involves an attacker sending a specially crafted HTTP/2 transaction to a Suricata instance that has rules using http.response_header with and without a transform. The root cause of this vulnerability is the improper handling of memory in the Http2ThreadMultiBuf, leading to a use-after-free condition when such transactions are inspected.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP/2 transaction to a Suricata instance. When the transaction is inspected by rules that use http.response_header with and without a transform, it triggers the use-after-free condition in Http2ThreadMultiBuf. This can lead to potential code execution or crashes, allowing an attacker to achieve high confidentiality and integrity impacts and low availability impacts.

Impact Assessment

Suricata versions before 8.0.7 are affected by this vulnerability. The CVSS score of 9.4 indicates a critical severity level, with high impacts on confidentiality and integrity and a low impact on availability. Successful exploitation could allow an attacker to execute arbitrary code or cause a denial-of-service condition.

Recommended Actions

To mitigate this vulnerability, security professionals should update Suricata to version 8.0.7 or later. Additionally, implementing network segmentation and monitoring network traffic to detect potential exploitation attempts can help reduce the risk. Detection guidance includes monitoring Suricata logs for unusual activity and applying the provided patches or updates.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-94084
  • Suricata Forum - Suricata 8.0.7 Released
  • GitHub Commit - Fix Http2ThreadMultiBuf use-after-free
  • GitHub Compare - Suricata 8.0.6 to 8.0.7