The flaw occurs when an HTTP/2 server sends a GOAWAY frame while a GNOME application is uploading a file. The libsoup HTTP/2 client mishandles the asynchronous data read, freeing memory that is still in use. The result is a heap use‑after‑free that can corrupt memory and potentially allow an attacker to read confidential data or execute code with the privileges of the client process. This vulnerability is categorized as CWE‑416, improper use of memory after it has been freed.

The issue is present in the libsoup library bundled with Red Hat Enterprise Linux 6, 7, 8, 9 and 10. Any GNOME application that relies on libsoup for HTTP/2 uploads on those distributions is potentially affected.

The CVSS score of 7.6 reflects a high severity. Exploitation requires control of an HTTP/2 server or a Man‑in‑the‑Middle position, which is a realistic attack vector for network operators or compromised servers. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, while exploitation is likely to be limited to targeted environments, the potential for arbitrary code execution makes it a significant threat if the attacker can influence the server that the client communicates with.