CriticalCritical vulnerability
CVE-2026-94084 (CVSS 9.4)
NVD · officialPublished Sep 20, 2026Risk 50/100EPSS 0.4%
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Technical details
CVSS
9.4
AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:Low
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source