CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

EUVD-2026-70953

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-85197

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-85197

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-85197

libsoup contains a heap use-after-free in its HTTP/2 client implementation, specifically in the on_data_read() function. The vulnerability is triggered when a GNOME application uploads a file over HTTP/2 and a malicious server or MITM attacker sends a GOAWAY frame while the file body is still bei...

CVE-2026-85197

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

PT-2026-86189

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the netfs pgpriv2 copy to cache function where a folio is marked with PG private 2 before being appended to the copy-to-cache rolling buffer via netfs pgpriv2 copy...

Understanding the Privacy-Preserving Potential of HTTP/2 against Webpage Fingerprinting

Website fingerprinting WF attacks can infer which webpage a user visits from encrypted HTTPS traffic alone, compromising privacy even without decryption. WF defenses commonly shape traffic through noise, padding, delays, or flow splitting, yet they are most often studied from the perspective of...

CVE-2021-44319: Uncontrolled Resource Consumption

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...

CVE-2026-82729: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...

PT-2026-85433

Name of the Vulnerable Software and Affected Versions libsoup versions prior to 3.6.6-9.1 Description A heap use-after-free flaw exists in the HTTP/2 client implementation. This issue occurs when a GNOME application uploads a file using HTTP/2 and the server sends a GOAWAY frame while the file bo...

PT-2026-85474

Content removed...

RHEL 8 : grafana-pcp (RHSA-2026:63124)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63124 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

Linux Distros Unpatched Vulnerability : CVE-2026-85197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client...

RHEL 10 : grafana-pcp (RHSA-2026:63119)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63119 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

CVE-2026-85534: Reachable Assertion

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...

PT-2026-91371

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS INITIAL WINDOW SIZE while that buffered read is still in...