# CVE-2026-15713: libsoup memory leak in HTTP/2 stream termination

Source: https://junglewise.ai/threats/cve-2026-15713-libsoup-memory-leak-in-http-2-stream-termination  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15713 · Severity: medium · CVSS 5.9 · Published 2026-07-14

A memory management issue was found in libsoup, a networking library used by many Linux applications to handle web traffic. An attacker can exploit this flaw by sending specifically timed network signals that trick the library into leaking small amounts of memory. Over time, this causes the affected application to consume all available system memory and crash, leading to a denial of service.

Technologies: [Gnome Libsoup](https://junglewise.ai/threats/technologies/libsoup). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-15713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15713 being exploited in the wild.

**How severe is CVE-2026-15713?** Medium severity, with a CVSS score of 5.9, published 14 July 2026.

**Which products and versions are affected?** Gnome Libsoup Enterprise Linux 10.

**Is there a fix for CVE-2026-15713?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15713?** Check whether you run Gnome Libsoup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak exists in libsoup's HTTP/2 connection pooling engine, specifically within the stream cleanup logic in soup-client-message-io-http2.c. The library fails to properly release memory context blocks and stream state descriptors when encountering specific termination conditions, such as HTTP/2 window exhaustion or explicit RST_STREAM signals. A remote, unauthenticated attacker acting as a malicious network peer can trigger these conditions across many concurrent streams. Over a sustained period, the incremental heap exhaustion leads to an Out-of-Memory (OOM) application crash. The vulnerability is tracked as CWE-772.

## Affected products

- Red Hat libsoup3 Enterprise Linux 10
- Red Hat libsoup Enterprise Linux 8, 9
- GNOME libsoup

## Timeline

- 2026-07-14: disclosed: Initial report via Red Hat Bugzilla and NVD publication.

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-15713](https://access.redhat.com/security/cve/CVE-2026-15713)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2499941](https://bugzilla.redhat.com/show_bug.cgi?id=2499941)
- [https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541](https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541)

## Related threats

- [libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client)
- [libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate)
- [libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is)
- [libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri)
- [libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented)