A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-debuginfoUpgrade libsoup3-debugsourceUpgrade libsoup3Upgrade libsoup3-develUpgrade libsoup3-doc | Sep 30, 2026 | Sep 4, 2026 |
| Redhat_linux | — | Upgrade libsoup3Upgrade libsoup3-debugsourceUpgrade libsoup3-docUpgrade libsoup3-debuginfoUpgrade libsoup3-devel | Sep 18, 2026 | Sep 3, 2026 |
| Ubuntu | — | Upgrade gir1.2-soup-2.4Upgrade libsoup-3.0-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-1Upgrade gir1.2-soup-2.4 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade gir1.2-soup-3.0 (Ubuntu Pro)Upgrade libsoup-3.0-0Upgrade gir1.2-soup-3.0Upgrade libsoup2.4-1Upgrade libsoup2.4-commonUpgrade libsoup-3.0-commonUpgrade libsoup2.4-devUpgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup-2.4-1Upgrade libsoup2.4-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-devUpgrade libsoup-3.0-devUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup-gnome2.4-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup-3.0-common (Ubuntu Pro)Upgrade libsoup-3.0-0 (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub