Description

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-09-20T02:16:53.717Z",
  "pubdate": "2026-09-20T02:16:53.717Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Suricata versions prior to 8.0.7 within the HTTP/2 inspection engine.\nThe vulnerability resides specifically in the Http2ThreadMultiBuf component, triggered during the inspection of HTTP/2 transactions that employ specific rule-based header inspection logic.\nThe flaw occurs when a transaction is evaluated against multiple rules, specifically where a combination of 'http.response_header' with and without data transformations is utilized.\nAn unauthenticated, remote attacker could potentially exploit this condition by crafting malicious HTTP/2 traffic designed to trigger the invalid memory access.\nThe impact of successful exploitation includes potential application crashes resulting in a Denial of Service (DoS) condition, or potentially arbitrary code execution depending on the specific state of the heap at the time of the use-after-free event.\nThis vulnerability poses a significant risk to network security infrastructure, as Suricata is frequently deployed as an edge security gateway. Patching to version 8.0.7 or later is required to address this memory management flaw.",
  "technicalDetails": "The root cause of this vulnerability is a heap memory management error within the Suricata HTTP/2 inspection logic, specifically localized to the Http2ThreadMultiBuf structure.\nThe vulnerability manifests during the processing of HTTP/2 response headers when the detection engine applies disparate inspection strategies simultaneously: one applying a transformation (e.g., normalization or modification) and another performing a raw assessment via 'http.response_header' without transformations.\nThe use-after-free condition occurs because the memory allocated for the HTTP/2 transaction buffer is prematurely freed or released while references to the buffer object persist within the detection engine's rule evaluation context.\nWhen the engine processes a rule that triggers a transformation, the internal representation of the header data is updated. If the subsequent rule or the same inspection logic continues to operate on the original pointer address without verifying the lifecycle state of the buffer, it accesses memory that has already been returned to the allocator.\nAttack flow: An attacker initiates an HTTP/2 session and delivers a carefully crafted response header sequence. The Suricata engine initializes the Http2ThreadMultiBuf to track transaction state. As rules are applied, the engine encounters a scenario where concurrent inspection logic attempts to access the buffer. If the first rule path completes a modification that triggers a re-allocation or free operation of the buffer, and the second rule path retains a stale pointer, the engine executes a read or write operation on the freed memory area.\nExploitation requirements include the presence of a ruleset containing overlapping HTTP/2 inspection rules. The vulnerability is network-exposed, requiring the attacker to be able to send HTTP/2 traffic to the interface monitored by the vulnerable Suricata instance.\nFrom a memory corruption perspective, the ability to control the contents of the freed memory block through subsequent heap allocations allows for potential control flow hijacking. By influencing the heap layout through heap spray techniques or by controlling the timing of packet arrival, an attacker might replace the freed object with malicious data, leading to a write-what-where primitive or redirecting execution flow to attacker-supplied shellcode if the memory is subsequently utilized as a function pointer or object method."
}