Description
A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
Published: 2026-07-14
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap buffer over‑read (CWE-125) occurs when libsoup processes an HTTP/2 GOAWAY frame. The library incorrectly assumes the Additional Debug Data payload is a safely NUL‑terminated string, so it reads past the allocated buffer when a malicious frame omits the null delimiter. This vulnerability can crash the application or expose fragments of memory, resulting in a denial of service or potential information disclosure.

Affected Systems

The flaw is present in Red Hat Enterprise Linux 10 systems that ship libsoup versions 3.0 through 3.7.0. Any service on those systems that uses libsoup to talk HTTP/2 is potentially affected.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can remotely exploit it by sending a malformed GOAWAY frame to a target that uses libsoup, thereby provoking a crash or exposing data without the need for authentication.

Generated by OpenCVE AI on July 31, 2026 at 05:48 UTC.

Remediation

Vendor Workaround

The vulnerability requires debug logging to be enabled with the G_MESSAGES_DEBUG environment variable, e.g. G_MESSAGES_DEBUG=all or G_MESSAGES_DEBUG=libsoup-http2. Ensure this environment variable is not set.

OpenCVE Recommended Actions

  • Apply the latest libsoup update that fixes the GOAWAY frame parsing logic.
  • Make sure the G_MESSAGES_DEBUG environment variable is unset or not set to 'libsoup-http2' to prevent the vulnerable code path from executing.
  • Restart any services that depend on libsoup after the patch and environment change to ensure the fix takes effect.
  • Optionally, implement application-level rate limiting or idle timeout for HTTP/2 GOAWAY frames to mitigate accidental or malicious abuse.

Generated by OpenCVE AI on July 31, 2026 at 05:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 14 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents. A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.

Tue, 14 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
Title Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-125
CPEs cpe:/o:redhat:enterprise_linux:10
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-14T19:15:43.984Z

Reserved: 2026-07-14T09:55:11.765Z

Link: CVE-2026-15712

cve-icon Vulnrichment

Updated: 2026-07-14T19:15:18.655Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-14T10:00:00Z

Links: CVE-2026-15712 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T06:00:16Z

Weaknesses