Critical severity9.4NVD Advisory· Published Sep 20, 2026· Updated Sep 28, 2026

CVE-2026-94084

Description

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Oisf/Suricata2 versions
cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*range: <8.0.7
- (no CPE)range: <8.0.7

Patches

Vulnerability mechanics

References

github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808nvdPatch
forum.suricata.io/t/suricata-8-0-7-released/6467nvdRelease Notes
github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7nvdRelease Notes

News mentions

Suricata: 19 Vulnerabilities Disclosed Together, Critical Flaws in HTTP/2 and DoH2 Parsers
Vypr Intelligence · Sep 20, 2026

cvss	0.611
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000