Libsoup's HTTP/2 implementation may retain memory allocations when a stream is terminated under specific conditions, such as window exhaustion or explicit resets. A remote, unauthenticated attacker can act as a malicious network peer, sending the allocation of stream states that are later leaked during cleanup. Over a sustained connection, the leaked system's heap and causing the application to crash with an out‑of-memory remote denial of service by provoking a runaway memory leak. The weakness is identified as CWE‑772.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 include the affected libsoup library. The CVE does not specify vulnerable exact versions, but all releases listed in the CNA data ship a copy of libsoup that contains the bug. System administrators should verify which version of libsoup is installed on each host and plan for remediation accordingly.

The CVSS score of 5.9 indicates a moderate risk, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA's KEV catalog. The attacker can exploit the flaw by maintaining a long‑lived HTTP/2 session with a server that uses the vulnerable libsoup library; no authentication or special privileges are required. While the attack requires assembling a persistent network connection, the resulting any process that relies on libsoup for HTTP/2 handling, potentially impacting availability across the compromised host.