Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-14T10:20:00 libsoup: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-772

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

This flaw poses a moderate availability impact to applications leveraging libsoup for modern HTTP/2 communications. Because the memory leakage accrues iteratively over standard session handling paths, an attacker can reliably cause a service disruption without needing local system privileges or user interaction. Red Hat Product Security notes that while the impact is bounded to a local application process termination, it remains a severe reliability risk for persistent cloud daemons or desktop clients communicating over untrusted wide-area network nodes. Red Hat would like to thank cavid for reporting this issue. Users should avoid connecting to untrusted HTTP/2 servers. Implementing network egress filtering to restrict outbound connections to only trusted destinations can reduce exposure to this vulnerability. Red Hat Enterprise Linux 10 Fix deferred libsoup3 Red Hat Enterprise Linux 6 Out of support scope libsoup Red Hat Enterprise Linux 7 Out of support scope libsoup Red Hat Enterprise Linux 8 Fix deferred libsoup Red Hat Enterprise Linux 9 Fix deferred libsoup https://www.cve.org/CVERecord?id=CVE-2026-15713 https://nvd.nist.gov/vuln/detail/CVE-2026-15713 https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541