CVE-2026-94084

www.tenable.com • September 20, 2026

Share: View original

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

Published : 2026-09-20

Vector : CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Suricata Flaws Allow Network Crashes On September 20, 2026, the OISF released Suricata 8.0.7 to address two critical vulnerabilities, CVE-2026-94084 and CVE-2026-94083, both with a CVSS score of 9.4. These flaws allow unauthenticated attackers to crash the Suricata IDS/IPS, bypassing network monitoring. CVE-2026-94084 is a use-after-free vulnerability in HTTP/2 inspection, while CVE-2026-94083 involves type confusion in the DoH2 parser. Both vulnerabilities affect all Suricata versions prior to 8.0.7. The flaws expose significant risks, especially in environments using default configurations. Organizations are urged to update to the latest version to mitigate these risks. 2 sources 72

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

CWE-416 - Use After Free

Platforms (1)

Vulnerabilities (1)

Http2ThreadMultiBuf Use-after-free