The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-debugsourceUpgrade libsoup3Upgrade libsoup3-develUpgrade libsoup3-debuginfoUpgrade libsoup3-doc | Sep 30, 2026 | Sep 4, 2026 |
| Ubuntu | — | Upgrade libsoup2.4-dev (Ubuntu Pro)Upgrade gir1.2-soup-2.4 (Ubuntu Pro)Upgrade libsoup-gnome2.4-devUpgrade libsoup-3.0-0 (Ubuntu Pro)Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade libsoup-3.0-devUpgrade libsoup-3.0-commonUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup-3.0-0Upgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-devUpgrade gir1.2-soup-3.0 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade gir1.2-soup-3.0Upgrade libsoup-2.4-1Upgrade libsoup-gnome2.4-1Upgrade libsoup-3.0-dev (Ubuntu Pro)Upgrade libsoup2.4-commonUpgrade libsoup-3.0-common (Ubuntu Pro)Upgrade gir1.2-soup-2.4Upgrade libsoup-gnome2.4-dev (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub