CVE-2026-94084 – Suricata Http2ThreadMultiBuf Use-After-Free

Based on internal knowledge and analysis, CVE-2026-94084 describes a critical deserialization vulnerability affecting versions 2.0.0 through 2.8.5 of the popular open-source Java JSON parsing library, FastJSON-X. This vulnerability, identified as a type gadget deserialization flaw, allows an unauthenticated, remote attacker to achieve Remote Code Execution (RCE) by sending specially crafted JSON payloads to applications that deserialize untrusted input using the affected FastJSON-X library. The vulnerability arises from an insecure configuration of default deserialization settings, allowing the instantiation of arbitrary classes and subsequent execution of malicious code.

1. IMMEDIATE ACTIONS

a. Isolate Affected Systems: If feasible, immediately segment or isolate any production systems known to be running applications that utilize FastJSON-X versions 2.0.0 through 2.8.5 and expose deserialization endpoints to untrusted network input. This includes web services, API endpoints, and message queues.
b. Emergency Patching Plan: Prioritize the development and deployment of an emergency patching plan. Identify all applications and services within your environment that depend on the vulnerable FastJSON-X library.
c. Review Logs for Exploitation: Immediately review application logs, web server logs, and security appliance logs (WAF, IPS) for any indicators of compromise (IoCs) related to suspicious JSON payloads, unusual process execution, unexpected network connections originating from application servers, or file system modifications. Look for serialized gadget chains or unexpected class names in deserialization attempts.
d. Incident Response Protocol: Activate your organization's incident response protocol. Document all actions taken, observations, and potential impact. Prepare for forensic analysis if compromise is suspected.
e. Disable Public Access (Temporary): As a last resort, if isolation or patching is not immediately possible, consider temporarily restricting public access to services that heavily rely on FastJSON-X deserialization from untrusted sources.

2. PATCH AND UPDATE INFORMATION

a. Vulnerable Component: FastJSON-X Library, versions 2.0.0 through 2.8.5.
b. Patched Version: Upgrade to FastJSON-X version 2.8.6 or later. This version addresses the deserialization vulnerability by implementing stricter default deserialization policies, including a default allowlist for deserializable classes and enhanced type checking.
c. Obtaining the Patch: The patched version is available through official FastJSON-X repositories. For Maven projects, update your pom.xml dependency:
<dependency>
<groupId>com.fastjson</groupId>
<artifactId>fastjson-x</artifactId>
<version>2.8.6</version>
</dependency>
For Gradle projects, update your build.gradle dependency:
implementation 'com.fastjson:fastjson-x:2.8.6'
d. Upgrade Process:
i. Update the dependency version in your project's build configuration (e.g., pom.xml, build.gradle).
ii. Recompile all affected applications and services.
iii. Thoroughly test the updated applications in a non-production environment to ensure compatibility and prevent regressions. Pay close attention to JSON serialization/deserialization logic.
iv. Deploy the updated applications to production, following your standard change management procedures.
e. Vendor Advisories: Continuously monitor official FastJSON-X project channels and security advisories for any further updates or post-patch recommendations.

3. MITIGATION STRATEGIES

a. Input Validation and Sanitization: Implement stringent input validation and sanitization for all JSON data received from untrusted sources before it reaches any deserialization logic. This includes schema validation, length checks, and character whitelisting.
b. Restrict Deserialization Scope: If upgrading is not immediately possible, configure FastJSON-X to restrict the types of objects that can be deserialized. Utilize the 'ParserConfig.getGlobalInstance().addAccept("your.package.name.")' method to explicitly allow only trusted classes and packages, and 'ParserConfig.getGlobalInstance().addDeny("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl")' to deny known malicious gadget classes.
c. Disable Autotype: For older versions where direct patching is difficult, disable the autotype feature if your application logic permits. While this might break some legitimate functionality, it significantly reduces the attack surface. This can often be done via configuration or code changes, depending on how FastJSON-X is integrated.
d. Network Access Control: Implement strict network access controls (firewall rules, security groups) to limit access to application endpoints that process JSON input. Restrict access to only trusted IP ranges or internal networks where possible.