CVE-2026-94084: Suricata HTTP/2 Use-After-Free Vulnerability

CVE-2026-94084 Overview

CVE-2026-94084 is a use-after-free vulnerability [CWE-416] in the Suricata network intrusion detection and prevention system (IDS/IPS). The flaw resides in the Http2ThreadMultiBuf component. It is triggered when a transaction is inspected by rules that use http.response_header both with and without a transform. All Suricata releases prior to 8.0.7 are affected.

Critical Impact

A remote attacker can trigger memory corruption in Suricata sensors over the network without authentication or user interaction, potentially leading to sensor compromise or disruption of network monitoring.

Affected Products

• Suricata versions prior to 8.0.7
• Deployments using HTTP/2 inspection with http.response_header rules
• Rule sets combining http.response_header with and without transforms in the same ruleset

Discovery Timeline

• 2026-09-20 - CVE-2026-94084 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94084

Vulnerability Analysis

The vulnerability exists in Suricata's HTTP/2 inspection engine, specifically the Http2ThreadMultiBuf structure used to hold per-thread multi-buffer state during rule evaluation. When a single transaction is inspected by rules that reference the http.response_header sticky buffer both with and without an accompanying transform, Suricata frees memory associated with the buffer while a reference to it remains reachable.

Subsequent access to the freed memory during rule evaluation constitutes a use-after-free condition. The upstream fix landed in commit 1d66355dc8737bb2ae7a198115b3067e3ad49808 and shipped in Suricata 8.0.7. Reviewers can compare changes between 8.0.6 and 8.0.7 in the OISF Suricata release comparison.

Root Cause

The root cause is incorrect lifetime management of the Http2ThreadMultiBuf buffer when the detection engine evaluates multiple rules referencing the same HTTP/2 response header content with differing transform states. The buffer is released while an alias to it is still consulted by another rule in the evaluation chain [CWE-416].

Attack Vector

Exploitation requires an attacker to send crafted HTTP/2 response traffic through a Suricata sensor configured with a ruleset that contains at least one http.response_header rule with a transform and one without. Because Suricata inspects passing traffic, the attack requires no authentication and no user interaction on the sensor. A malicious server responding to a monitored client, or an attacker on the wire, can supply the triggering response.

The Suricata 8.0.7 release announcement and upstream commit contain the technical details of the corrected buffer handling.

Detection Methods for CVE-2026-94084

Indicators of Compromise

• Unexpected Suricata process crashes, restarts, or SIGSEGV entries in system logs on sensors running versions prior to 8.0.7.
• Gaps in Suricata alert or eve.json output correlating with inbound HTTP/2 response traffic.
• Core dumps produced by the suricata binary during HTTP/2 inspection.

Detection Strategies

• Inventory all Suricata deployments and identify instances running versions earlier than 8.0.7.
• Audit active rulesets for combinations of http.response_header rules with and without transforms that could trigger the code path.
• Enable and monitor Suricata's internal engine statistics for abnormal termination or restart counts.

Monitoring Recommendations

• Forward Suricata process telemetry, eve.json, and host logs to a centralized analytics platform for continuous review.
• Alert on repeated Suricata service restarts within short time windows on any monitored sensor.
• Correlate sensor instability with HTTP/2 traffic volume to identify probable exploitation attempts.

How to Mitigate CVE-2026-94084

Immediate Actions Required

• Upgrade all Suricata sensors to version 8.0.7 or later as tracked in the Suricata 8.0.7 release announcement.
• Prioritize sensors exposed to untrusted HTTP/2 traffic, including internet-facing perimeter and DMZ deployments.
• Restart Suricata after upgrade and validate that rulesets load without errors.

Patch Information

The fix is included in Suricata 8.0.7. The corrective change is upstream commit 1d66355dc8737bb2ae7a198115b3067e3ad49808. Distributions packaging Suricata should rebase to 8.0.7 or backport the referenced commit.

Workarounds

• Where immediate patching is not possible, temporarily disable rules that reference the http.response_header sticky buffer combined with transforms.
• Disable HTTP/2 parsing in suricata.yaml under the app-layer.protocols.http2 section if HTTP/2 inspection is not required for the deployment.
• Restrict sensor exposure to trusted network segments until the upgrade to 8.0.7 is completed.

# Verify installed Suricata version
suricata --build-info | head -n 1

# Disable HTTP/2 inspection as a temporary workaround (suricata.yaml)
# app-layer:
#   protocols:
#     http2:
#       enabled: no

# Reload rules after configuration change
sudo suricatasc -c reload-rules