Executive brief
libsoup is an HTTP library used by GNOME applications to communicate with web servers. A malicious HTTP/2 server or network attacker can trigger a memory corruption vulnerability when a file upload is interrupted with a GOAWAY frame, potentially leading to sensitive data exposure or complete compromise of the affected application.
Technical details
A heap use-after-free vulnerability exists in libsoup's HTTP/2 client implementation within the on_data_read() function. The flaw is triggered when a server sends a GOAWAY frame while the HTTP/2 client is asynchronously reading a file body during upload. This results in memory being freed and subsequently accessed, causing memory corruption. An attacker controlling an HTTP/2 server or performing a man-in-the-middle (MITM) attack on the network can exploit this condition to achieve information disclosure or arbitrary code execution. A patch is available in libsoup3 as of September 2026.
Affected products
- GNOME libsoup <unknown
Timeline
- 2026-09-04: disclosed
- 2026-09-16: advisory: Red Hat RHSA-2026:68235 issued for libsoup3 in Red Hat Enterprise Linux 10