Suricata EUVD-2026-83639

Requires (1) the sensor to be inspecting HTTP/2 traffic and (2) a ruleset containing rules that use the http.response_header keyword BOTH with a transform and without a transform on the same transaction - this dual-rule condition is what triggers the buffer reuse leading to the use-after-free. The malicious data originates from an HTTP/2 server response, so the attacker must control or induce traffic to a server whose responses traverse the Suricata sensor. Limiting factors: exploitation depends entirely on this specific detection-configuration (not guaranteed on default/minimal rulesets), affects only Suricata versions before 8.0.7, and the reliably-observable outcome is engine crash/memory disclosure rather than confirmed code execution.

The vendor-supplied CVSS 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) overstates real-world priority for a UAF in an inspection engine. The bug is a CWE-416 use-after-free in Suricata's HTTP/2 detection code (rust/src/http2/detect.rs), triggered when the same response-header multi-buffer is inspected by rules using http.response_header BOTH with and without a transform - that dual-rule condition is a deployment prerequisite, not attacker-controlled, which argues for AC:H rather than AC:L. The commit shows dangling references arising from tbuf.data reassignment and a push()-then-borrow pattern in http2_escape_header; the most demonstrable outcome of such a detect-buffer UAF is a crash of the Suricata process (loss of network monitoring, i.e. A:H), with possible disclosure of freed memory into inspection buffers/logs (C:L). Full C:H/I:H (reliable code execution) is asserted but not evidenced. No EPSS score, no CISA KEV entry, and no public exploit are provided - exploitation status is 'no public exploit identified at time of analysis.' Net: a genuine memory-safety bug worth patching promptly on affected sensors, but the practical risk is degradation/crash of the security-monitoring layer under a specific ruleset rather than mass-exploitable RCE. Missing data: no EPSS/KEV/POC, and the C:H/I:H impact claims cannot be verified from the diff.

An attacker who controls (or lures a monitored client to) an HTTP/2 server sends crafted response headers that traverse a Suricata sensor whose ruleset inspects http.response_header both with and without a transform. During inspection the reused/freed multi-buffer is dereferenced, causing a use-after-free that most reliably crashes the Suricata engine and blinds network monitoring. No public exploit code is identified, and attack complexity is elevated by the specific dual-rule configuration requirement.