CVE-2026-94084

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Sep 20, 2026, 1:20:20 AM UTC

Updated

Sep 20, 2026, 2:16:53 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.54% · Oct 25, 2026

An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management (`Http2ThreadMultiBuf`). When inspected HTTP/2 response traffic triggers signature rules that evaluate the `http.response_header` keyword simultaneously with and without sticky buffer transformations, the HTTP/2 state handler improperly reuses allocated memory buffers. An unauthenticated remote attacker can exploit this flaw by transmitting crafted HTTP/2 server response frames across monitored network segments, leading to memory corruption, a daemon crash resulting in Denial of Service (DoS), or potentially arbitrary code execution within the context of the Suricata process. This issue affects Suricata versions prior to 8.0.7. A flaw was found in Suricata's HTTP/2 engine (`Http2ThreadMultiBuf`). When HTTP/2 response traffic is inspected by rules mixing `http.response_header` with and without transformations, a use-after-free condition occurs. A remote, unauthenticated attacker can exploit this by sending crafted HTTP/2 responses through inspected paths, causing a daemon crash or potentially arbitrary code execution with the privileges of the Suricata process. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.