CVE-2026-94084 Use after free in Suricata

Critical 9.4 Published 20 Sep 2026 Updated 22 Sep 2026

Suricata suffers from a use-after-free vulnerability in HTTP/2 processing, potentially allowing attackers to execute code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-94084?

CVE-2026-94084 is a critical use after free vulnerability in Oisf Suricata, published on 20 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

Weakness: CWE-416

Which versions are affected by CVE-2026-94084?

It affects 1 product.

Products include Oisf Suricata.

How do I fix CVE-2026-94084?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-94084 being exploited?

There is no known exploitation of CVE-2026-94084 in the wild and no public exploit code.

All Oisf Suricata vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-94084, GHSA-4jpj-5857-48jp, UBUNTU-CVE-2026-94084.