CVE-2026-94084 OISF CVE debrief

Who should care

Network security teams and administrators using Suricata for network traffic analysis and security monitoring should assess their exposure and prioritize upgrading to version 8.0.7 or later.

Why it matters

This vulnerability has a critical CVSS score of 9.4 and can impact network security monitoring and traffic analysis. Network security teams and administrators should assess their exposure and prioritize upgrading to version 8.0.7 or later.

• Potential for remote code execution
• Possible disruption of network security monitoring
• Potential for evasion of security controls
• Requires verification of affected versions and remediation

Technical summary

The vulnerability occurs in the Http2ThreadMultiBuf component of Suricata. When a transaction is inspected by rules that use http.response_header with and without a transform, a use-after-free error can occur. This issue impacts systems using Suricata for network traffic analysis and security monitoring. The vulnerability can lead to potential remote code execution and disruption of network security monitoring. The CVE record and NVD entry provide additional technical details on the vulnerability. The vulnerability has a critical CVSS score of 9.4.

Defensive priority

High priority for systems using Suricata for security monitoring and network traffic analysis

Recommended defensive actions

• Upgrade Suricata to version 8.0.7 or later
• Review and update Suricata rules to ensure they are compatible with version 8.0.7 or later
• Monitor Suricata logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The NVD entry is currently Analyzed. The vulnerability has a critical CVSS score of 9.4. The Http2ThreadMultiBuf component of Suricata is affected. The vulnerability occurs in the context of network traffic analysis and security monitoring. The NVD entry provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.