# CVE-2026-94084

Use-after-free in Suricata HTTP/2 processing enabling crash or possible RCE

- Page: https://www.vulneraibility.com/cve/CVE-2026-94084
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.54% (percentile 45.6)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-416
- Published: 2026-09-20

## Affected versions

- OISF Suricata: affected < 8.0.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Crafted HTTP/2 traffic can trigger a use-after-free during http.response_header rule inspection, enabling remote code execution or denial of service.

## Action

Immediate action required

## Recommendation

Upgrade to Suricata 8.0.7+ immediately and restart sensors

## References

- [other] https://forum.suricata.io/t/suricata-8-0-7-released/6467
- [other] https://github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808
- [other] https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.