CVE-2026-15712: Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption
A flaw was found in libsoup's HTTP/2 protocol parsing logic where processing malformed network frames can trigger a heap buffer over-read condition.
Component / Vulnerable Part:
libsoup -> HTTP/2 connection processing backend (soup-client-message-io-http2.c or similar HTTP/2 state engine components handling GOAWAY frames).
Technical Analysis & Root Cause:
When an HTTP/2 session receives a GOAWAY frame, the frame can contain an optional "Additional Debug Data" payload field. The libsoup library erroneously treats this debug data block as a standard, safely NUL-terminated C-string without explicitly verifying the payload length boundaries provided by the framing layer. If a remote peer constructs a malicious GOAWAY frame containing a debug string that lacks a terminating \0 byte within the bounds of the frame allocation, internal string functions will read past the allocated heap space looking for the delimiter.
Impact:
A remote attacker acting as a malicious HTTP/2 endpoint can transmit a specially crafted GOAWAY frame to read out-of-bounds heap memory. This results in an immediate application crash (Denial of Service) or potential information disclosure of adjacent memory metadata.
Other sources
A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.0 - Compensating control
Mitigate exploitation by preventing untrusted remote peers from establishing HTTP/2 connections to the affected application (e.g., restrict inbound/outbound network paths for HTTP/2 to trusted endpoints only, or block HTTP/2 where feasible at the network edge).
- Compensating control
As an operational risk reduction, disable HTTP/2 for clients/servers using libsoup if your deployment supports it, so GOAWAY frame parsing in the HTTP/2 backend is not exercised.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15712?
CVE-2026-15712 has a medium severity rating of 5.9.
How do I fix CVE-2026-15712?
To mitigate CVE-2026-15712, update libsoup to a version that addresses this heap buffer over-read vulnerability.
What systems are affected by CVE-2026-15712?
CVE-2026-15712 affects systems using the Gnome libsoup library.
What type of vulnerability is CVE-2026-15712?
CVE-2026-15712 is a heap buffer over-read vulnerability that occurs in the HTTP/2 connection tracking framework of libsoup.
What happens if I exploit CVE-2026-15712?
Exploiting CVE-2026-15712 may allow an attacker to cause memory-related issues or potentially lead to denial of service.