CVE-2026-94084

Executive Summary

CVE-2026-94084 is a use-after-free (CWE-416) vulnerability in Suricata, the open-source network intrusion detection and prevention engine, affecting all versions before 8.0.7. The flaw is triggered inside the Http2ThreadMultiBuf component when an HTTP/2 transaction is inspected by rules that use the http.response_header keyword both with and without a transform — a specific rule-authoring combination that leads to improper memory lifecycle handling of a multi-buffer object. With a CVSS 3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), the impact is critical: an unauthenticated remote attacker who can deliver HTTP/2 traffic to an inspected interface may achieve high confidentiality and integrity impact plus limited availability impact against the Suricata process itself.

Technical Analysis

Suricata is a high-performance, multi-threaded signature-based IDS/IPS and network security monitoring engine. It parses and normalizes protocol traffic — here HTTP/2 — and exposes protocol fields to the detection engine via keywords. Two relevant keywords in this CVE are:

• http.response_header — a sticky buffer keyword used in signatures to match content within HTTP response headers.
• A transform — a content-modifying or field-derivation operation applied to a sticky buffer (e.g., header normalization/decoding) before matching.

The vulnerable code path is in Http2ThreadMultiBuf. The NVD description states a use-after-free occurs "when a transaction is inspected by rules that use http.response_header with and without a transform."

Mechanism at the vulnerability-class level (CWE-416): A use-after-free arises when memory backing the HTTP/2 multi-buffer object is released (freed) but a subsequent rule inspection still dereferences a pointer to that region. The trigger condition is the mixed usage pattern: some signatures reference http.response_header directly while others reference the same buffer through a transform. The transform path and the non-transform path appear to manage the lifetime of the underlying multi-buffer differently — one path frees or reinitializes the buffer (or its backing allocation) while the other retains a live pointer. When both rule styles evaluate the same HTTP/2 transaction, the detection engine can access memory after it has been returned to the allocator.

Consequences of the UAF:

1. Memory corruption — dereferencing freed memory can yield arbitrary values used as buffer pointers, lengths, or offsets within the multi-buffer handling logic.
2. Potential code execution or crash — if the reused memory region is attacker-influenced, classic UAF primitives (controlled reallocation, pointer overwrite) can lead to control-flow hijack or at minimum a denial of service via crash. The CVSS vector's A:L (not A:H) suggests availability impact exists but is not the dominant outcome relative to confidentiality/integrity (C:H/I:H), consistent with data disclosure and corruption of the inspection process.
3. Detection integrity compromise — a security sensor itself is the target; corruption of the pipeline can cause missed detections or false output for subsequent traffic on the same thread.

Attack surface: The vulnerability is reachable over the network (AV:N) through HTTP/2 traffic traversing the sensor, with no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L). The prerequisite is that the deployment loads signatures that combine http.response_header usage with and without a transform — a configuration-dependent condition reflected in the CVSS scope being unchanged (S:U).

Affected versions: Suricata before 8.0.7, per the NVD description. No CPE or package data (affected versions list, OSV packages) was provided by tracked sources, so the precise version floor is not enumerated beyond "before 8.0.7."

Root cause confidence: The NVD description is authoritative for the affected component (Http2ThreadMultiBuf), protocol (HTTP/2), keywords (http.response_header, transforms), and bug class (use-after-free). No patch diff, commit, or advisory text is available from tracked sources, so the exact instruction sequence that frees and later reuses the buffer cannot be stated with certainty and is not fabricated here.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-94084 (PoC_STATUS: None; Exploit Code: NO). The chain below is inferred strictly from the vulnerability class and the NVD-described trigger condition. Per accuracy policy: no exploit tooling, function names, or API parameters are invented beyond those appearing verbatim in the NVD description (Http2ThreadMultiBuf, http.response_header, transform).

1) Reconnaissance / target identification The attacker must identify a network path that is inspected by a Suricata sensor running a pre-8.0.7 version and whose rule set contains signatures matching HTTP/2 response headers via http.response_header, in the vulnerable mixed-transform configuration. This is reconnaissance about the defensive stack, not the protected application. An attacker positioned on a network segment delivering HTTP/2 (e.g., an upstream client or a compromised server whose responses are inspected) can probe for the presence of HTTP/2 handling and infer sensor deployment by observing whether traffic is blocked, rate-limited, or reset by an inline IPS.

2) Triggering the flaw class The flaw is triggered when a single HTTP/2 transaction is inspected by rules that use http.response_header both with and without a transform. The attacker crafts HTTP/2 response headers embedded in a transaction that traverses the sensor. The specific header content, length, or encoding is chosen to reach the code path where the transform-based and non-transform-based inspections of the Http2ThreadMultiBuf object interact incorrectly. Because the trigger is content/lifecycle interaction rather than a specific injection string (as would be the case for injection classes), the attacker's controllable variable is the volume and shape of the HTTP/2 response-header transactions delivered — repeated transactions maximize the chance of hitting the mixed inspection path and of shaping the freed region.

3) Execution method at the vulnerability-class level This is memory-safety exploitation, not injection. The general UAF steps are: (a) cause the multi-buffer backing allocation to be freed while a reference to it persists; (b) influence the contents of the freed region through a subsequent allocation (reallocation shaping) so that the surviving pointer now references attacker-controlled or attacker-influenced data; (c) induce the detection engine to dereference the stale pointer, corrupting memory or redirecting a computation. No public exploit demonstrates these steps for this CVE. Whether the freed region is attacker-controllable in practice depends on allocator behavior in Http2ThreadMultiBuf's allocation path, which is not documented in the available data.

4) Post-exploitation impact Given CVSS base subscores C:H/I:H/A:L, successful exploitation may enable high-impact disclosure of data processed by the sensor and high-integrity impact (corruption of the inspection pipeline, memory, or blocked/allowed decisions), with limited but real availability impact (crash/DoS of the engine). The most reliable, code-level-independent outcome is a denial-of-service crash of the Suricata process when a crafted HTTP/2 transaction hits the vulnerable rule combination — a security-infrastructure outage that degrades monitoring and inline enforcement. Realistic weaponization would target the sensor as high-value infrastructure: blinding IDS/IPS detection, or attempting memory corruption in a process that typically runs with elevated network privileges.

Threat actor applicability: No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided intelligence (CISA KEV: NO). The pattern fits both advanced actors seeking to blind defenses and opportunistic actors seeking DoS against exposed sensor infrastructure.

Impact Assessment

• CVSS 3.1 Base 9.4 (Critical) — AV:N reachable over the network; AC:L no special conditions beyond the vulnerable rule configuration; PR:N no credentials; UI:N no user action; S:U impact confined to the Suricata security scope; C:H/I:H high confidentiality and integrity impact; A:L limited availability impact.
• Affected systems: Any asset running Suricata < 8.0.7 that (a) processes HTTP/2 and (b) loads rule sets combining http.response_header with and without transforms. This includes inline IPS deployments, passive IDS sensors, NSM/DPI nodes, and third-party products and appliances that embed Suricata as their detection core. Because Suricata is widely embedded, the blast radius is potentially broad, though exact list of downstream embeds is not enumerated by tracked sources.
• Business impact: The compromised asset is the defense itself. A crash causes a monitoring/enforcement blind spot and loss of logging/telemetry supply for the SOC. High C:H/I:H scores imply the flaw could also lead to corruption of the detection result — false negatives on subsequent traffic, or, if exploited beyond DoS, memory corruption within a network-perimeter process. Loss of an inline IPS can mean downstream systems lose blocking protection.
• Exploitability context: EPSS not yet scored by FIRST.org; no public PoC, no Nuclei template, not in CISA KEV. The realistic near-term risk is a reliability/DoS-impacting trigger by anyone able to send HTTP/2 to an inspected segment, with in-the-wild exploitation unconfirmed.
• Privilege context: Suricata often runs as a privileged or dedicated service with packet capture/forwarding rights; memory corruption in such a process undermines adjacent trust boundaries even though CVSS scope is unchanged.

Detection Guidance

Note: no public exploit exists, so the following rules detect the configurational precondition (Suricata < 8.0.7 with mixed http.response_header transform rules), process health anomalies (Suricata crashes/restarts), and HTTP/2 traffic volume patterns. Tune to your environment.

Sigma Rule

title: Suricata Process Crash or Restart Indicating Possible CVE-2026-94084 Use-After-Free
id: 3f9c1e42-94084-4b7a-9d21-suricata-uaf
status: experimental
description: Detects abnormal termination or rapid restart of the Suricata process consistent with a crash triggered by the Http2ThreadMultiBuf use-after-free (CVE-2026-94084).
author: Threat Intelligence / valtersit.com
date: 2026/01/01
logsource:
    product: linux
    service: syslog
detection:
    selection_suricata:
        - 'suricata'
        - 'Suricata'
    selection_crash:
        - 'segfault'
        - 'Segmentation fault'
        - 'signal 11'
        - 'SIGSEGV'
        - 'core dumped'
        - 'worker' 
    selection_restart:
        - 'Starting Suricata'
        - 'suricata.service: Succeeded'
    condition: selection_suricata and (selection_crash or selection_restart)
falsepositives:
    - Legitimate Suricata restarts during upgrades or reconfiguration
    - Expected crashes from other known bugs
level: high
tags:
    - attack.t1190
    - cve.2026.94084

YARA Rule

rule CVE_2026_94084_Suricata_Http2ThreadMultiBuf_UAF
{
    meta:
        description = "Correlates Suricata binary/build strings for pre-8.0.7 versions to flag exposure to CVE-2026-94084 (Http2ThreadMultiBuf use-after-free)"
        author = "Threat Intelligence / valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-94084"
        cve = "CVE-2026-94084"

    strings:
        $sym1 = "Http2ThreadMultiBuf" ascii
        $kw1  = "http.response_header" ascii
        $ver_prefix = "8.0." ascii

    condition:
        uint32(0) == 0x464C457F and   // ELF binary
        $sym1 and
        $kw1
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-94084 Suricata Http2ThreadMultiBuf UAF - excessive HTTP2 response-header transaction volume"; flow:established,from_server; app-layer-protocol:http2; http.response_header; threshold: type both, track by_src, count 200, seconds 10; classtype:attempted-dos; sid:2026094084; rev:1; reference:cve,2026-94084;)

Because the trigger is a lifecycle interaction inside the engine rather than a byte signature, the paired Suricata-side rule above is a volumetric / anomaly guard that fires on the HTTP/2 response-header traffic shape that reaches the vulnerable code path. Do not treat it as a definitive detector.

Elastic Detection

process where host.os.type == "linux" and
  event.action in ("end", "exit") and
  process.name == "suricata" and
  (process.exit_code != 0 or process.command_line like "*suricata*")

Recommended EQL variant for correlation over a short window:

sequence by host.id with maxspan=2m
  [process where process.name == "suricata" and not process.exit_code == 0]
  [process where process.name == "suricata"]

Detects a Suricata process terminating abnormally and restarting within 2 minutes, a pattern consistent with a repeated crash trigger. Adds no false confidence — pair with host logs (dmesg for SIGSEGV, core dumps).

Splunk SPL Query

index=os OR index=syslog sourcetype=journald OR sourcetype=syslog
("suricata" OR "Suricata")
("Segmentation fault" OR "signal 11" OR "SIGSEGV" OR "core dumped" OR "worker" OR "starting" OR "Starting Suricata")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, _raw
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Investigate hosts where Suricata restarts more than once in the window — repeated restarts strongly indicate a reproducible crash trigger.

Wazuh OSSEC Rule

<group name="suricata,cve-2026-94084,">
  <rule id="202694084" level="12">
    <decoded_as>syslog</decoded_as>
    <match>suricata</match>
    <regex>Segmentation fault|signal 11|SIGSEGV|core dumped|worker</regex>
    <description>CVE-2026-94084: Suricata crash/SIGSEGV possibly due to Http2ThreadMultiBuf use-after-free</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94084,attack,</group>
  </rule>
  <rule id="202694085" level="8" frequency="2" timeframe="120">
    <if_matched_sid>202694084</if_matched_sid>
    <description>CVE-2026-94084: Repeated Suricata crashes - suspected use-after-free trigger loop</description>
    <group>cve_2026_94084,correlation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source (Patch Sources: [], Vendor Fix: N/A, Workarounds: N/A). The NVD description references "before 8.0.7," which implies version 8.0.7 addresses the flaw, but this is not corroborated by a vendor advisory, release note, or commit in the provided data. Treat the following as proactive guidance until a verified fix is confirmed.

1) Immediate mitigations (until 8.0.7 is validated):

• Disable the vulnerable rule combination. Review loaded rule sets for signatures using http.response_header and eliminate the mixed usage — i.e., ensure a given buffer is not inspected by both transform and non-transform rules. Where feasible, disable one variant of the conflicting rules to break the trigger condition.
• Break the precondition, not the sensor. If HTTP/2 inspection is not operationally required, constrain Suricata's HTTP/2 app-layer parser (reject or downgrade HTTP/2 where the rule set does not depend on it) so the vulnerable Http2ThreadMultiBuf path is not exercised.
• Isolate and watchdog the process. Run Suricata under a supervisor (systemd Restart=on-failure, or a process manager) with core-dump capture enabled so crashes are auto-recovered and forensic evidence preserved. Restrict the sensor's network exposure so only trusted segments can deliver inspected HTTP/2 traffic.
• Minimize exposure. Because the vector is network-reachable (AV:N, PR:N), ensure sensors are not reachable by untrusted parties where deployment permits (segment placement, ACLs on capture interfaces).

2) Patch / upgrade steps:

• Monitor the Suricata project (Open Information Security Foundation) release channel for a verified 8.0.7 (or later) release and its accompanying security advisory/commit.
• On availability, stage 8.0.7 in a lab, reproduce the mixed http.response_header rule configuration, and confirm no UAF/crash occurs before production rollout.
• Upgrade all embedded/third-party Suricata-based appliances by pulling the vendor's corresponding firmware update once the upstream fix is incorporated.
• Validate post-upgrade: confirm process version, re-enable the previously disabled conflicting rules, and monitor for restarts.

3) Long-term hardening:

• Maintain a golden copy of production rule sets and continuously scan for rule combinations that inspect the same parser buffer through divergent code paths; treat such combinations as high-risk.
• Run Suricata with least privilege (dedicated user, capability-based capture where possible) and enable hardening (ASLR, stack protector, hardened allocator) to reduce the impact of memory-safety bugs.
• Centralize crash telemetry (dmesg, journald, core dumps) into the SIEM with alerting on repeated sensor restarts.
• Subscribe to NVD, the Suricata security mailing list, and your embedding vendor's advisories; monitor for CISA KEV addition and EPSS scoring once assigned.
• Include a fail-safe that raises an alert (not silent failure) whenever inline IPS capability is degraded by a restart, so enforcement gaps are visible to the SOC.

References

• NVD — CVE-2026-94084: https://nvd.nist.gov/vuln/detail/CVE-2026-94084
• CWE-416 Use After Free: https://cwe.mitre.org/data/definitions/416.html
• Suricata project (OISF) security information: https://suricata.io/ (verify 8.0.7 advisory/release when published)
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-94084 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: None reported. No public PoC, no Nuclei template, no exploit code, not in CISA KEV, EPSS not yet scored. Attack chain in this report is inferred from the documented vulnerability class (CWE-416) and the NVD-described trigger condition only.