Bug 2538834 (CVE-2026-94084)

An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management (`Http2ThreadMultiBuf`). When inspected HTTP/2 response traffic triggers signature rules that evaluate the `http.response_header` keyword simultaneously with and without sticky buffer transformations, the HTTP/2 state handler improperly reuses allocated memory buffers. An unauthenticated remote attacker can exploit this flaw by transmitting crafted HTTP/2 server response frames across monitored network segments, leading to memory corruption, a daemon crash resulting in Denial of Service (DoS), or potentially arbitrary code execution within the context of the Suricata process. This issue affects Suricata versions prior to 8.0.7.