58 matches found
AlmaLinux 10 : libsoup3 (ALSA-2026:68235)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68235 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...
SUSE CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
DEBIAN-CVE-2026-85534
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...
CVE-2026-85534 Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...
CVE-2026-85534
A flaw in libsoup 's HTTP/2 client can crash the process when a malicious server manipulates flow-control settings. When a client sends a request body from a non-pollable input stream , the library may buffer more data than the current flow-control window allows. A remote HTTP/2 server can then s...
CVE-2026-85534 Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progres...
AZL-99915 CVE-2026-85197 affecting package libsoup 3.4.4-16
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
DEBIAN-CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
EUVD-2026-70953
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-85197
libsoup contains a heap use-after-free in its HTTP/2 client implementation, specifically in the on_data_read() function. The vulnerability is triggered when a GNOME application uploads a file over HTTP/2 and a malicious server or MITM attacker sends a GOAWAY frame while the file body is still bei...
CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
Linux Distros Unpatched Vulnerability : CVE-2026-85197
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client...
PT-2026-85433
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
AZL-91212 CVE-2026-48619 affecting package nodejs for versions less than 24.17.0-1
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...