The flaw occurs when a libsoup HTTP/2 client reads an upload body from a non‑pollable input stream. The client may buffer more data than a flow‑control window later permits. A malicious server can issue SETTINGS_INITIAL_WINDOW_SIZE small changes while the read is still in progress. The client then copies the entire buffer into a new DATA frame without a runtime bounds check, causing the process to abort or the HTTP/2 session to fail. This results in a client crash or service outage but does not provide code execution or data compromise.

Red Hat Enterprise Linux 6, 7, 8, 9 and 10 contain the vulnerable version of libsoup and therefore are impacted.

The CVSS score of 5.9 indicates a moderate impact. EPSS is not available and the vulnerability is not in the CISA KEV catalog, so known exploitation evidence is lacking. The likely attack path requires a malicious or compromised HTTPS/2 server that can send a SETTINGS_INITIAL_WINDOW_SIZE frame while a client is reading a large request body. The client, acting as the victim, is not required to be privileged or have local access; thus the vector is remote and achievable over the network.