# CVE-2026-4271: GNOME libsoup use-after-free in HTTP/2 server implementation

Source: https://junglewise.ai/threats/cve-2026-4271-gnome-libsoup-use-after-free-in-http-2-server-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-17. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-4271 · Severity: medium · CVSS 5.3 · Published 2026-03-17

A vulnerability has been identified in libsoup, a widely used library for handling web requests in GNOME-based applications and Linux environments. An attacker can send specially crafted network traffic to a server using this library, causing it to crash or become unstable. This results in a denial-of-service, potentially disrupting applications that rely on this library for network communication.

Technologies: [Gnome Libsoup](https://junglewise.ai/threats/technologies/libsoup), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-4271 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4271 being exploited in the wild.

**How severe is CVE-2026-4271?** Medium severity, with a CVSS score of 5.3, published 17 March 2026.

**Which products and versions are affected?** Gnome Libsoup 3.6.5-3.el10_1.11, 3.6.5-3.el10_1.11, 3.6.5-3.el10_0.15; Gnome Libsoup3 3.6.5-3.el10_1.11.

**Is there a fix for CVE-2026-4271?** A patch was published on 2026-05-11: Red Hat released security advisory RHSA-2026:15968 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4271 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4271?** Check whether you run Gnome Libsoup, Gnome Libsoup3 or Red Hat Enterprise Linux 10 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the HTTP/2 server implementation of libsoup (CWE-416). The flaw is triggered when a remote, unauthenticated attacker sends specially crafted HTTP/2 requests that result in authentication failures. This sequence causes the application to attempt to access memory that has already been deallocated, leading to memory corruption and application crashes. While Red Hat assigned a CVSS score of 5.3 (Medium), NIST has assigned a score of 7.5 (High) due to the potential for complete service unavailability. Patches have been released for various Red Hat Enterprise Linux versions (libsoup3 packages).

## Affected products

- GNOME libsoup3 3.6.5-3.el10_1.11, 3.6.5-3.el10_0.15
- GNOME libsoup
- Red Hat Enterprise Linux 10.0
- Red Hat Enterprise Linux 9.0
- Red Hat Enterprise Linux 8.0
- Red Hat Enterprise Linux 7.0
- Red Hat Enterprise Linux 6.0

## Timeline

- 2026-03-17: disclosed: Initial disclosure and CVE assignment
- 2026-05-11: patched: Red Hat released security advisory RHSA-2026:15968
- 2026-05-14: patched: Red Hat released security advisory RHSA-2026:17482
- 2026-05-19: patched: Red Hat released security advisory RHSA-2026:19143

## References

- [https://access.redhat.com/errata/RHSA-2026:15968](https://access.redhat.com/errata/RHSA-2026:15968)
- [https://access.redhat.com/errata/RHSA-2026:17482](https://access.redhat.com/errata/RHSA-2026:17482)
- [https://access.redhat.com/errata/RHSA-2026:19143](https://access.redhat.com/errata/RHSA-2026:19143)
- [https://access.redhat.com/security/cve/CVE-2026-4271](https://access.redhat.com/security/cve/CVE-2026-4271)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2448044](https://bugzilla.redhat.com/show_bug.cgi?id=2448044)
- [https://gitlab.gnome.org/GNOME/libsoup/-/issues/496](https://gitlab.gnome.org/GNOME/libsoup/-/issues/496)

## Related threats

- [libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client)
- [libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate)
- [libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is)
- [libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri)
- [libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented)