A flaw was discovered in libsoup, the library that handles HTTP requests. In its HTTP/2 server path a use‑after‑free condition allows a remote attacker to send specially crafted HTTP/2 frames that trigger the library to dereference freed memory. The result is instability or a crash of the application using libsoup, which in turn can bring the service down and cause a denial of service. The weakness is identified as CWE‑416.

The vulnerability exists in the libsoup library shipped with Red Hat Enterprise Linux v6, v7, v8, v9, and v10 as listed in the provided CPE entries. The vendor’s CNA data confirms that these operating system releases contain the affected libsoup component, but specific package versions are not enumerated in the input.

The CVSS score of 5.3 points to a medium severity issue, while an EPSS score of less than 1% suggests that exploitation in the wild is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by contacting any service that receives HTTP/2 requests via libsoup; no special credentials or elevated privileges are needed. Successful exploitation results in a crash or instability of the target application, thereby denying availability to legitimate users.