- Description
- Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
- Source
- cve@mitre.org
- NVD status
- Analyzed
- Products
- suricata
CVSS 3.1
- Type
- Secondary
- Base score
- 9.4
- Impact score
- 5.5
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- Severity
- CRITICAL
- cve@mitre.org
- CWE-416
- Hype score
- Not currently trending
Warning: Critical vulnerabilities affecting #Suricata. CVE-2026-94083 (CVSS: 9.4) allows an attacker to trigger a DoS. CVE-2026-94084 (CVSS: 9.4) allows an attacker to conduct DoS or execute arbitrary code due to memory corruption #RCE! #Patch #Patch #Patch
@CCBalert
22 Sept 2026
254 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
⚠️ Vulnerabilidades en productos Suricata ❗ CVE-2026-94084 ❗ CVE-2026-94083 ➡️ Más info: https://t.co/xqYpFt492n https://t.co/yzkl6XTGV1
@CERTpy
21 Sept 2026
211 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Twój IDS też jest powierzchnią ataku. Suricata <8.0.7 ma krytyczne błędy HTTP/2: CVE-2026-94083 i CVE-2026-94084. Jeden dotyczy domyślnie aktywnego DoH2. Aktualizuj do 8.0.7+ i sprawdź konfigurację parserów. #Linux #Security #Suricata https://t.co/R8KMZg3aVZ
@quietcodelife
21 Sept 2026
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Suricata's HTTP2 engine had two critical memory-safety bugs at once both fixed in a single release. CVE-2026-94083 is a DoH2 type confusion causing an invalid free. CVE-2026-94084 is a separate Http2ThreadMultiBuf use-after-free triggered by http.response_header rules. Both are
@vuln_tracker
21 Sept 2026
208 Impressions
0 Retweets
4 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-94084 (CVSS 9.4) affects Suricata before 8.0.7. Update promptly if using the tool with HTTP response header rules. https://t.co/GklzL4xCok via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/bLXWn8ac0P
@ADKCyber
20 Sept 2026
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
A new vulnerability with increased severity was disclosed for OISF Suricata (CVE-2026-94084) https://t.co/oqEGMGNWMz
@vuldb
20 Sept 2026
88 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE577A8B-F5DB-475C-ACFD-899D5E2B7C69",
"versionEndExcluding": "8.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]