Executive brief
libsoup is a networking library used by many applications to handle HTTP/2 communications. An attacker running a malicious HTTP/2 server can cause a client application using libsoup to crash or terminate its session by exploiting a buffer handling flaw during file uploads. This affects availability of any application relying on libsoup for HTTP/2 uploads from non-pollable streams.
Technical details
A buffer overflow vulnerability exists in libsoup's HTTP/2 implementation (on_data_source_read_callback) when handling request bodies from non-pollable input streams (e.g., GFileInputStream). The flaw occurs when a malicious HTTP/2 server shrinks the SETTINGS_INITIAL_WINDOW_SIZE parameter while a buffered read is in progress. The client then attempts to copy the full buffer into a smaller DATA callback without runtime bounds validation, causing an assertion failure (CWE-617). The vulnerability requires a client to initiate an HTTP/2 request body upload to an attacker-controlled server. In Red Hat builds with assertions enabled, this results in process abort rather than memory corruption. The vulnerability affects libsoup 3.0.0 and later versions.
Affected products
- GNOME libsoup 3.0.0 and later
Timeline
- 2026-09-04: disclosed