CVE-2026-94084CWE-416

CVE-2026-94084

Critical · published September 20, 2026

CVSS v3.1
9.4
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-416 · Use After Free
Published
2026-09-20T06:16Z
Affected products (1)
ProductVersionsFixed in
oisf/suricata< 8.0.78.0.7
References (3)
https://forum.suricata.io/t/suricata-8-0-7-released/6467 · [email protected]https://github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808 · [email protected]https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7 · [email protected]
EPSS history
Timeline
  • 21 SEP 03:37Z
    EPSS moved — → 0%
    epss
  • 20 SEP 01:20Z
    Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a…
    cvelistv5