Executive brief
A memory management issue was found in libsoup, a networking library used by many Linux applications to handle web traffic. An attacker can exploit this flaw by sending specifically timed network signals that trick the library into leaking small amounts of memory. Over time, this causes the affected application to consume all available system memory and crash, leading to a denial of service.
Technical details
A memory leak exists in libsoup's HTTP/2 connection pooling engine, specifically within the stream cleanup logic in soup-client-message-io-http2.c. The library fails to properly release memory context blocks and stream state descriptors when encountering specific termination conditions, such as HTTP/2 window exhaustion or explicit RST_STREAM signals. A remote, unauthenticated attacker acting as a malicious network peer can trigger these conditions across many concurrent streams. Over a sustained period, the incremental heap exhaustion leads to an Out-of-Memory (OOM) application crash. The vulnerability is tracked as CWE-772.
Affected products
- Red Hat libsoup3 Enterprise Linux 10
- Red Hat libsoup Enterprise Linux 8, 9
- GNOME libsoup
Timeline
- 2026-07-14: disclosed: Initial report via Red Hat Bugzilla and NVD publication.