CVE-2026-94084 – OISF Suricata
“When the sensor watching your network can be crashed by the traffic it inspects, your defenses go dark at the worst possible moment.”
This Suricata update fixes seven vulnerabilities in the network intrusion detection and prevention engine, including three Critical flaws. CVE-2026-94083 has a CVSS score of 9.4, Critical severity, and CVE-2026-94084 has a CVSS score of 9.4, Critical severity. Both affect HTTP/2 handling: a DoH2 type confusion that triggers an invalid free, and a use-after-free during HTTP response header inspection. CVE-2026-45764 has a CVSS score of 9.1, Critical severity, and is an HTTP/2 type confusion that crashes the engine. CVE-2026-57228 has a CVSS score of 8.2, High severity, and is an out-of-bounds read in the SMTP MIME decoder. CVE-2026-45747 has a CVSS score of 7.5, High severity, and is a NULL dereference in the Lua TLS certificate helper. Proof-of-concept code exists for this flaw. CVE-2026-45770 has a CVSS score of 7.5, High severity, and lets an overloaded Lua rule corrupt detection state and escape the Lua sandbox. CVE-2026-57223 has a CVSS score of 7.0, High severity, and is an unquoted Windows service path that lets a local attacker run code as LocalSystem.
Crafted network traffic can knock Suricata offline and leave the network unmonitored. Several flaws also corrupt memory or escalate privileges. Versions 8.0.7 and 7.0.17 fix these issues. Upgrade 8.x deployments to 8.0.7 and 7.x deployments to 7.0.17.
Key Details
- Affected Product
- Oisf Suricata
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-416