CVE-2026-94084: 
Suricata vulnerability analysis and mitigation

CVE-2026-94084 is a use-after-free vulnerability in Suricata's HTTP/2 detection engine, specifically in the Http2ThreadMultiBuf structure, triggered when a transaction is inspected by rules using http.response_header both with and without a transform. It affects all Suricata versions before 8.0.7, developed by the Open Information Security Foundation (OISF). The vulnerability was published on September 20, 2026, with a patch released in Suricata 8.0.7. It carries a CVSS v3.1 base score of 9.4 (Critical) (Github Advisory, Feedly).

The root cause is a use-after-free (CWE-416) in Suricata's Rust-based HTTP/2 detection code (rust/src/http2/detect.rs). The Http2ThreadMultiBuf structure holds a list of owned Vec buffers for HTTP/2 headers. When a single transaction is inspected by two rule sets — one using http.response_header with a transform and one without — the code for the second list_id freed and reallocated the underlying buffer memory, while raw pointers to the original buffers remained in use during DetectRunPrefilterTx, resulting in a use-after-free condition. The fix replaces the destructive reassignment (tbuf.data = v) with an in-place rewrite (tbuf.data.clear(); tbuf.data.extend_from_slice(&v)), mirroring the approach already used for HTTP/1 processing. An unauthenticated remote attacker can trigger this by sending specially crafted HTTP/2 traffic to a monitored network segment where vulnerable Suricata rules are active (Github Commit, Github Advisory).

Successful exploitation can result in arbitrary code execution within the Suricata process or a crash of the service, impacting confidentiality, integrity, and availability of the network monitoring layer. Because Suricata often runs with elevated privileges as a network security sensor, a compromise could allow an attacker to disable or manipulate intrusion detection/prevention capabilities, potentially enabling further undetected lateral movement across the monitored network. The CVSS assessment reflects high confidentiality and integrity impact with low availability impact, and the vulnerability is classified as automatable with total technical impact (Github Advisory, Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is network-accessible, requires no authentication or user interaction, and is classified as automatable by NVD SSVC analysis, making it attractive for future weaponization. The EPSS score is approximately 0.40–0.54%, placing it in the 43rd percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify network segments monitored by Suricata versions prior to 8.0.7, particularly deployments using http.response_header detection rules with transforms (e.g., base64 decode, dotprefix) alongside rules using the same keyword without transforms.
2. Craft HTTP/2 traffic: Prepare HTTP/2 responses with headers specifically designed to trigger both the transformed and non-transformed http.response_header rule paths in the same transaction inspection cycle.
3. Trigger the use-after-free: Send the crafted HTTP/2 traffic through the monitored network so that Suricata's DetectRunPrefilterTx inspects the transaction, causing the Http2ThreadMultiBuf buffer to be freed and reallocated while stale pointers remain in use.
4. Achieve code execution or crash: Depending on memory layout and timing, the use-after-free may result in arbitrary code execution within the Suricata process (potentially with elevated privileges) or a denial-of-service crash of the sensor, effectively blinding the network monitoring layer (Github Commit, Github Advisory).

• Process: Unexpected crashes or restarts of the suricata process, particularly when processing HTTP/2 traffic; segmentation faults or memory corruption errors in Suricata logs.
• Logs: Suricata error logs (/var/log/suricata/suricata.log) showing memory-related panics, Rust Vec out-of-bounds errors, or abrupt process termination during HTTP/2 transaction inspection.
• Network: Unusual or malformed HTTP/2 response traffic with crafted headers targeting monitored segments; repeated connection attempts designed to trigger specific rule combinations involving http.response_header with and without transforms.
• File System: Core dump files generated by Suricata process crashes in the working directory or /var/crash/; unexpected Suricata process restarts recorded in system logs (e.g., journalctl -u suricata).

Upgrade Suricata to version 8.0.7 or later, which contains the fix (commit 1d66355) that replaces destructive buffer reassignment with safe in-place rewriting (Github Commit, Suricata Forum). As an interim workaround, review and modify active Suricata rulesets to avoid using http.response_header both with and without a transform on the same transaction, which is the specific pattern that triggers the vulnerability. Additionally, consider restricting network access to Suricata or disabling HTTP/2 deep inspection if operationally feasible until the patch is deployed (Feedly).

Coverage of CVE-2026-94084 appeared across multiple security news outlets and community platforms shortly after disclosure. The Hacker Wire published a dedicated technical article on the vulnerability (The Hacker Wire), and Forkast News framed it alongside related Suricata flaws as a threat to the network monitoring layer itself (Forkast News). Community discussion appeared on Reddit's r/pwnhub and Infosec.exchange, with posts noting the patch availability in 8.0.7 and the critical CVSS score. Undercode News also highlighted the irony of security sensors themselves being vulnerable (Undercode News).