Http2ThreadMultiBuf Use-After-Free in Suricata

Executive Summary

CVE-2026-94084 is a use-after-free vulnerability in Suricata's HTTP/2 detection module. It occurs when a transaction is inspected by rules using http.response_header with and without a transform. The Http2ThreadMultiBuf structure stores buffers for HTTP/2 headers. During a second inspection, the code frees existing buffers and allocates new ones, causing a use-after-free when further checks are performed.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Suricata version and inspecting rules using http.response_header with transforms. Run 'suricata -V' to verify version. If using Suricata 8.0.6 or earlier, the vulnerability likely exists. Review rules for http.response_header usage across multiple inspection passes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to crash Suricata or potentially execute arbitrary code, leading to denial-of-service conditions or unauthorized access to network traffic analysis. Systems relying on Suricata for intrusion detection may become unstable or compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Suricata to version 8.0.7 or later immediately. This version fixes the Http2ThreadMultiBuf use-after-free issue. After upgrading, restart Suricata to apply changes. Review and update rules to avoid mixing http.response_header with and without transforms in the same transaction.

Useful 0 Not Useful 0