CVE-2026-15712

Deferred Deferred - Pending Action

Heap Buffer Over-Read in libsoup HTTP/2 Connection Tracking

Publication date: 2026-07-14

Last updated on: 2026-07-14

Assigner: Red Hat, Inc.

Description

A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-14

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15712

EUVD

EUVD-2026-44341

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	From 3.0 (inc) to 3.7.0 (inc)
libsoup	libsoup	From 3.0 (inc) to 3.7.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-15712 is a heap buffer over-read vulnerability in libsoup's HTTP/2 connection tracking framework. When processing an HTTP/2 GOAWAY frame, the library fails to verify the length of the Additional Debug Data payload, assuming it is a NUL-terminated C-string. A malformed frame without a null delimiter can cause the library to read past the allocated buffer, leading to a denial of service or potential memory exposure.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using libsoup 3.0 to 3.7.0 when processing HTTP/2 traffic. Check logs for segmentation faults or heap corruption errors. Use network monitoring tools like Wireshark to inspect HTTP/2 GOAWAY frames for malformed payloads. Enable debug logging in libsoup to trace frame processing.

Impact Analysis

This vulnerability can cause applications using libsoup to crash, resulting in a denial of service. In some cases, it may also expose fragments of memory contents, potentially leaking sensitive information. The impact is limited to systems using vulnerable versions of libsoup (3.0 to 3.7.0) for HTTP/2 communication.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data through memory leaks, which may violate GDPR or HIPAA requirements for data protection. Organizations using affected libsoup versions should patch to prevent unauthorized data disclosure and ensure regulatory compliance.

Mitigation Strategies

Immediately update libsoup to a patched version (3.7.1 or later). If updating is not possible, disable HTTP/2 support in affected applications or block malformed GOAWAY frames at the network perimeter. Apply strict input validation for HTTP/2 frames in custom code using libsoup.

Hi! I’m here to help you understand CVE-2026-15712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70